Overview

overview

10

Static

static

9

mod_c.exe

windows7_x64

10

mod_c.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    mod_c.exe

  • Size

    1.8MB

  • Sample

    210326-r96vq4f4hs

  • MD5

    be4c5e4713009e5446ee042ba7c33fe0

  • SHA1

    f8e52380b6f3668d4de6df416c8da389c0d98fe8

  • SHA256

    7272457bac023e7ab635fc3d82212a89918de36d5433dd389e6151805e47b0cd

  • SHA512

    96612ab271e5adbfc911d65abc5ed56973d3539ff98c10e13daac782dcbfa43606ed89fa8efa0b203fd000cbbf76fea04d3844723c9dc075ba9a4fe55cb78e4d

Score
10/10
cryptonepackerransomware

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\HOW-TO-DECRYPT-dvxr9.txt

Ransom Note
[+] What happened? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has extension *.dvxr9 By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant get back your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] Using a TOR browser! - Download and install TOR browser from this site: https://torproject.org/ - Open our website: http://o76s3m7l5ogig4u5.onion - Follow the on-screen instructions Extension name: *.dvxr9 ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) will make everything possible for restoring, but please do not interfere.��
URLs

http://o76s3m7l5ogig4u5.onion

Targets

    • Target

      mod_c.exe

    • Size

      1.8MB

    • MD5

      be4c5e4713009e5446ee042ba7c33fe0

    • SHA1

      f8e52380b6f3668d4de6df416c8da389c0d98fe8

    • SHA256

      7272457bac023e7ab635fc3d82212a89918de36d5433dd389e6151805e47b0cd

    • SHA512

      96612ab271e5adbfc911d65abc5ed56973d3539ff98c10e13daac782dcbfa43606ed89fa8efa0b203fd000cbbf76fea04d3844723c9dc075ba9a4fe55cb78e4d

    Score
    10/10
    cryptonepackerransomware

    • CryptOne packer

      Detects CryptOne packer defined in NCC blogpost.

      cryptonepacker

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks