General

  • Target

    6b7d70ca7d02133afbc24eeb585f2921bc35c01b23b90a66f515290c49cf0952

  • Size

    60KB

  • Sample

    210412-5wsk5sahc2

  • MD5

    a53e1725d0d8f8c4616c625e113d3426

  • SHA1

    733ec0a491555e4563839ef273b66cb94f0c4163

  • SHA256

    6b7d70ca7d02133afbc24eeb585f2921bc35c01b23b90a66f515290c49cf0952

  • SHA512

    20abc180c481c21422aca29b17fd11b3200d2a84ee08bc68c747b4e91dc01f904829b0c224d02006d0fe0f895b0422b3f74883c9dad504b5bd560ec18da0e7ed

Malware Config

Extracted

Path

\??\c:\users\admin\desktop\info.txt

Ransom Note
Hello my dear friend Unfortunately for you, a major IT security weakness left you open to attack, your files have been encrypted If you want to restore them, install ICQ software on your PC https://icq.com/windows/ or on your mobile phone search in Appstore / Google market "ICQ" Write to our ICQ @Polsat https://icq.im/Polsat Write this ID in the title of your message EFA3802D-3178 Free decryption as guarantee Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. EVERY DAY PRICE WILL BE HIGHER IN YOUR INTEREST TO DO ALL FAST
URLs

https://icq.com/windows/

https://icq.im/Polsat

Extracted

Path

C:\users\public\desktop\info.hta

Ransom Note
Hello my dear friend Unfortunately for you, a major IT security weakness left you open to attack, your files have been encrypted If you want to restore them, install ICQ software on your PC https://icq.com/windows/ or on your mobile phone search in Appstore / Google market "ICQ" Write to our ICQ @Polsat https://icq.im/Polsat Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. As early you write us - then lower will be price We give all guarantees of your files decryption Hola mi querido amigo Desafortunadamente para usted, una gran debilidad de seguridad de TI lo dejó expuesto a ataques, sus archivos han sido encriptados Si desea restaurarlos, instale el software ICQ en su PC https://icq.com/windows/ o en su teléfono móvil busque en Appstore / Google market "ICQ" Escribe a nuestro ICQ @Polsat https://icq.im/Polsat ¡Atención! No cambie el nombre de los archivos cifrados. No intente descifrar sus datos utilizando software de terceros, puede causar una pérdida permanente de datos. Tan pronto como nos escriba, el precio será más bajo Damos todas las garantías de descifrado de sus archivos Ciao caro amico mio Sfortunatamente per te, una delle principali debolezze della sicurezza IT ti ha lasciato aperto agli attacchi, i tuoi file sono stati crittografati Se vuoi ripristinarli, installa il software ICQ sul tuo PC https://icq.com/windows/ o sul tuo cellulare cerca in Appstore / mercato Google "ICQ" Scrivi al nostro ICQ @Polsat @Polsat https://icq.im/Polsat Attenzione! Non rinominare i file crittografati. Non tentare di decrittografare i dati utilizzando software di terze parti, potrebbe causare la perdita permanente dei dati. Non appena ci scrivi, il prezzo sarà inferiore Diamo tutte le garanzie della decrittazione dei file Bonjour mon cher ami Malheureusement pour vous, une faille de sécurité informatique majeure vous a laissé ouvert aux attaques, vos fichiers ont été chiffrés Si vous souhaitez les restaurer, installez le logiciel ICQ sur votre PC https://icq.com/windows/ ou sur votre téléphone mobile recherchez dans Appstore / Google market "ICQ" Écrivez à notre ICQ @Polsat https://icq.im/Polsat Attention! Ne renommez pas les fichiers cryptés. N'essayez pas de déchiffrer vos données à l'aide d'un logiciel tiers, cela pourrait entraîner une perte de données permanente. Dès que vous nous écrivez - le prix sera inférieur Nous donnons toutes les garanties de décryptage de vos fichiers Hallo mein lieber Freund Unglücklicherweise haben Sie aufgrund einer großen IT-Sicherheitslücke offen für Angriffe. Ihre Dateien wurden verschlüsselt Wenn Sie sie wiederherstellen möchten, installieren Sie die ICQ-Software auf Ihrem PC https://icq.com/windows/ oder auf Ihrer Handysuche im Appstore / Google Market "ICQ". Schreiben Sie an unseren ICQ @Polsat https://icq.im/Polsat Beachtung! Benennen Sie verschlüsselte Dateien nicht um. Versuchen Sie nicht, Ihre Daten mit Software von Drittanbietern zu entschlüsseln, da dies zu einem dauerhaften Datenverlust führen kann. Sobald Sie uns schreiben - dann wird der Preis niedriger sein Wir geben alle Garantien für die Entschlüsselung Ihrer Dateien 你好我亲爱的朋友 对于您来说不幸的是,一个重大的IT安全漏洞使您容易受到攻击,您的文件已被加密 如果要还原它们,请在PC https://icq.com/windows/ 或在Appstore / Google市场“ ICQ”中的手机搜索上安装ICQ软件。 写信给我们的ICQ @Polsat https://icq.im/Polsat 注意力! 不要重命名加密的文件。 请勿尝试使用第三方软件解密数据,否则可能会导致永久性数据丢失。 尽早给我们写信-价格会更低 我们为您的文件解密提供所有保证
URLs

https://icq.com/windows/

https://icq.im/Polsat

Targets

    • Target

      6b7d70ca7d02133afbc24eeb585f2921bc35c01b23b90a66f515290c49cf0952

    • Size

      60KB

    • MD5

      a53e1725d0d8f8c4616c625e113d3426

    • SHA1

      733ec0a491555e4563839ef273b66cb94f0c4163

    • SHA256

      6b7d70ca7d02133afbc24eeb585f2921bc35c01b23b90a66f515290c49cf0952

    • SHA512

      20abc180c481c21422aca29b17fd11b3200d2a84ee08bc68c747b4e91dc01f904829b0c224d02006d0fe0f895b0422b3f74883c9dad504b5bd560ec18da0e7ed

    • Phobos

      Phobos ransomware appeared at the beginning of 2019.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies boot configuration data using bcdedit

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

    • Modifies Windows Firewall

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops desktop.ini file(s)

MITRE ATT&CK Matrix ATT&CK v6

Execution

Command-Line Interface

1
T1059

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

File Deletion

3
T1107

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

4
T1490

Tasks