General

  • Target

    Client-0.exe

  • Size

    94KB

  • Sample

    210413-bylytrx5w2

  • MD5

    22d0f1145b7f4f4a0c478ab27331909f

  • SHA1

    2c6f0936f7a8eaf7ca8e2669a50c86df0d9d21c8

  • SHA256

    9e573ba20b55f6149d801491c0ebb51c9f1c954b956a2f6cea6f18af68f0164b

  • SHA512

    ebca5fa978c534d54afdc9becd4ca7b1e1c288d4139a3140d06b4510344ac63f2d0c71526bd5c41c63e8457a6cef68cfd36923b940dcfb6374b09a777a00948c

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Ransom Note
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail black_privat@tuta.io or: darkseid@tutamail.com (backup mail) Send us this file RESTORE_FILES_INFO ================================================================================================================= Free decryption as a guarantee Before paying, you can send 1-2 files for free decryption. File format: txt doc pdf jpeg jpg gif png bmp Total file size should not exceed 2 MB (without archive) ====================================================== You can buy Bitcoins here: https://localbitcoins.com Or use the search how to buy Bitcoins in your country ================================================================================================================= IMPORTANT!!! Remember that your files are encrypted and only WE can recover them! Do not try to recover yourself, as well as on third-party resources, you will lose your files and money forever! ================================================================================================================= Key Identifier: Q5mni5/CEMfk7FfA4dmtBWyNLBDWljsgo7USYJUmlirztjya4i8g9r79FsEKr/3VSDstld81N5FwDq2GGG869jI2wBifBeqRsHn8Hkbk54lxUh/xGdpZK12fyA7q98idhKwxATbEPrzAaSrhQ5I2s0Uy+WGDtLovNjgdRNQ/MKCRSb+XI/xbK3fd0+5UDirXkD8pTXhhPzKZRonYsIRy3zvsl9NNYM7IcpH5cw4g/XU1f69AnQaM4lj399oO4iuNE7VPrsrcA3wESEQPQHyuqzqq4fnOZHDppYL3zDp0z04ZMxfZ5SKJFuVEwuH+32fpA3y+5hA6l54U7X9HgGG4voooa99KJHTOofEEb3Kf9xZMK1NMDgEan8IRWJnX+Ve3X/IsT3N+KEQ3BctHjFxNvMHOfcRbotGW2AaPpjvk5wKCeApozi8peuPAdBX2ygr/266FznLurCnKvjsaN6n2ZX7BFpxvSx4i0fzuvP/hg2YLe/iYZdU1mIG69oblfYKNQeCloAVjUOLPCDRvMFe0y/6fM39AlvFIsGdvWED1JotdqhG81nX33trjyeFDsE+PUzquP79OTXdXaxML/snL3SdfstJg2Vn+STDO+csDnhGy9iPxvu+rWfyQpcmggafP3L5XexjtN3ZFY0/L5/nIJHhXTuna9Td1LE7sTpSVhWU= PC Hardware ID: 58B980FB
Emails

black_privat@tuta.io

darkseid@tutamail.com

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt

Ransom Note
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail black_privat@tuta.io or: darkseid@tutamail.com (backup mail) Send us this file RESTORE_FILES_INFO ================================================================================================================= Free decryption as a guarantee Before paying, you can send 1-2 files for free decryption. File format: txt doc pdf jpeg jpg gif png bmp Total file size should not exceed 2 MB (without archive) ====================================================== You can buy Bitcoins here: https://localbitcoins.com Or use the search how to buy Bitcoins in your country ================================================================================================================= IMPORTANT!!! Remember that your files are encrypted and only WE can recover them! Do not try to recover yourself, as well as on third-party resources, you will lose your files and money forever! ================================================================================================================= Key Identifier: Q5mni5/CEMfk7FfA4dmtBWyNLBDWljsgo7USYJUmlirztjya4i8g9r79FsEKr/3VSDstld81N5FwDq2GGG869jI2wBifBeqRsHn8Hkbk54lxUh/xGdpZK12fyA7q98idhKwxATbEPrzAaSrhQ5I2s0Uy+WGDtLovNjgdRNQ/MKCRSb+XI/xbK3fd0+5UDirXkD8pTXhhPzKZRonYsIRy3zvsl9NNYM7IcpH5cw4g/XU1f69AnQaM4lj399oO4iuNE7VPrsrcA3wESEQPQHyuqzqq4fnOZHDppYL3zDp0z04ZMxfZ5SKJFuVEwuH+32fpA3y+5hA6l54U7X9HgGG4voooa99KJHTOofEEb3Kf9xZMK1NMDgEan8IRWJnX+Ve3X/IsT3N+KEQ3BctHjFxNvMHOfcRbotGW2AaPpjvk5wKCeApozi8peuPAdBX2ygr/266FznLurCnKvjsaN6n2ZX7BFpxvSx4i0fzuvP/hg2YLe/iYZdU1mIG69oblfYKNQeCloAVjUOLPCDRvMFe0y/6fM39AlvFIsGdvWED1JotdqhG81nX33trjyeFDsE+PUzquP79OTXdXaxML/snL3SdfstJg2Vn+STDO+csDnhGy9iPxvu+rWfyQpcmggafP3L5XexjtN3ZFY0/L5/nIJHhXTuna9Td1LE7sTpSVhWU= Number of files that were processed is: 512 PC Hardware ID: 58B980FB
Emails

black_privat@tuta.io

darkseid@tutamail.com

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Ransom Note
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail black_privat@tuta.io or: darkseid@tutamail.com (backup mail) Send us this file RESTORE_FILES_INFO ================================================================================================================= Free decryption as a guarantee Before paying, you can send 1-2 files for free decryption. File format: txt doc pdf jpeg jpg gif png bmp Total file size should not exceed 2 MB (without archive) ====================================================== You can buy Bitcoins here: https://localbitcoins.com Or use the search how to buy Bitcoins in your country ================================================================================================================= IMPORTANT!!! Remember that your files are encrypted and only WE can recover them! Do not try to recover yourself, as well as on third-party resources, you will lose your files and money forever! ================================================================================================================= Key Identifier: nv9IODO7PVweD/pIGiAwdhCLvjpQKXt+XKGx+uteo8kpYG4dp7HuUtn1wZ7LmUhzPh3RgxL8DpvdtwN4xakCJ7XovPma6MAtrzK9G8tN+tjLHmoQX3XJtf7wIFIZM+RMFhh+cB37H/PRJ8UFyNV0aWQJ+tFlJ9ESgJ9Fnbu7iLyosCz5QNpPPThx06S9OI+ehfUJ1b6PnoNHrCyq4QDd6zeXh6tMgq1aL8H7L0o/Uraab8kOq2zvAHLb7ax09Pr2BdU6zWzGMkmgMGpvc4LyIcBCf/9fvwliJgjTvxSHwHvN2lOd3tkwgBUokAHqNdhsld4TfglcTvAbfFwKJjaqJVxO6yCtM2veOg7pSKyEPoRKLY25SIhn8gmBkRLcn9cilb+L0vhZDylAjgu6rTxwbggDMeuI1HjnBTSMfSRuNatR2KwN3xgoeQi7BWK8FmuHbPKCWLbWwsijoABPlUwtxo09wZV4EROmNatzOTRqc7MTnVWWIQOQVyRQs5zko07ZDGiJdItRVm6hXDYWvurGFTFG+UW+OD4oflw81BeCB2PK8FFPyQ4J1DgVkRCdv6Lmkujb2bOjL1c/F+3SSKimQeEI+lVP/94AeQBi1EzSwj2KDK6DDGxas0Wbek+Ye1R2P29nJ/BIErXMZODYJ+3p2meYOflYi+rfcvPVtTpDkoY= PC Hardware ID: 3ED10BF6
Emails

black_privat@tuta.io

darkseid@tutamail.com

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt

Ransom Note
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail black_privat@tuta.io or: darkseid@tutamail.com (backup mail) Send us this file RESTORE_FILES_INFO ================================================================================================================= Free decryption as a guarantee Before paying, you can send 1-2 files for free decryption. File format: txt doc pdf jpeg jpg gif png bmp Total file size should not exceed 2 MB (without archive) ====================================================== You can buy Bitcoins here: https://localbitcoins.com Or use the search how to buy Bitcoins in your country ================================================================================================================= IMPORTANT!!! Remember that your files are encrypted and only WE can recover them! Do not try to recover yourself, as well as on third-party resources, you will lose your files and money forever! ================================================================================================================= Key Identifier: nv9IODO7PVweD/pIGiAwdhCLvjpQKXt+XKGx+uteo8kpYG4dp7HuUtn1wZ7LmUhzPh3RgxL8DpvdtwN4xakCJ7XovPma6MAtrzK9G8tN+tjLHmoQX3XJtf7wIFIZM+RMFhh+cB37H/PRJ8UFyNV0aWQJ+tFlJ9ESgJ9Fnbu7iLyosCz5QNpPPThx06S9OI+ehfUJ1b6PnoNHrCyq4QDd6zeXh6tMgq1aL8H7L0o/Uraab8kOq2zvAHLb7ax09Pr2BdU6zWzGMkmgMGpvc4LyIcBCf/9fvwliJgjTvxSHwHvN2lOd3tkwgBUokAHqNdhsld4TfglcTvAbfFwKJjaqJVxO6yCtM2veOg7pSKyEPoRKLY25SIhn8gmBkRLcn9cilb+L0vhZDylAjgu6rTxwbggDMeuI1HjnBTSMfSRuNatR2KwN3xgoeQi7BWK8FmuHbPKCWLbWwsijoABPlUwtxo09wZV4EROmNatzOTRqc7MTnVWWIQOQVyRQs5zko07ZDGiJdItRVm6hXDYWvurGFTFG+UW+OD4oflw81BeCB2PK8FFPyQ4J1DgVkRCdv6Lmkujb2bOjL1c/F+3SSKimQeEI+lVP/94AeQBi1EzSwj2KDK6DDGxas0Wbek+Ye1R2P29nJ/BIErXMZODYJ+3p2meYOflYi+rfcvPVtTpDkoY= Number of files that were processed is: 1818 PC Hardware ID: 3ED10BF6
Emails

black_privat@tuta.io

darkseid@tutamail.com

Targets

    • Target

      Client-0.exe

    • Size

      94KB

    • MD5

      22d0f1145b7f4f4a0c478ab27331909f

    • SHA1

      2c6f0936f7a8eaf7ca8e2669a50c86df0d9d21c8

    • SHA256

      9e573ba20b55f6149d801491c0ebb51c9f1c954b956a2f6cea6f18af68f0164b

    • SHA512

      ebca5fa978c534d54afdc9becd4ca7b1e1c288d4139a3140d06b4510344ac63f2d0c71526bd5c41c63e8457a6cef68cfd36923b940dcfb6374b09a777a00948c

    • TeslaCrypt, AlphaCrypt

      Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    • Modifies Windows Firewall

    • Deletes itself

    • Drops startup file

    • Modifies file permissions

    • Modifies WinLogon

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Winlogon Helper DLL

1
T1004

Defense Evasion

File Permissions Modification

1
T1222

Modify Registry

3
T1112

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Tasks