Resubmissions

14-04-2021 06:01

210414-le4vga68nn 10

13-04-2021 17:46

210413-1bgrp73q6a 10

General

  • Target

    a11cc5051e3a88428db495f6d8e4b6381a1cb3fa5946a525ef5c00bfcb44e210.bin

  • Size

    54KB

  • Sample

    210414-le4vga68nn

  • MD5

    0390938e8a9df14af45e264a128a5bf8

  • SHA1

    f90f83c3dbcbe9b5437316a67a8abe6a101ef4c3

  • SHA256

    a11cc5051e3a88428db495f6d8e4b6381a1cb3fa5946a525ef5c00bfcb44e210

  • SHA512

    c4b8d0d086a7f3c9aa83e2ad5baa36027cd8785878913b7dc0ad698066aaa0f298dec59cb6fb42cf76530c8be9b242bdacfb1253eb02a6ad84a872df4c586e98

Score
10/10

Malware Config

Extracted

Path

C:\\README.aeef1a75.TXT

Ransom Note
----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. DATA LEAK ---------------------------------------------- We have uploaded more than 1000 GB of data from your company (Contracts, payments, reports, personal data of your customers, employees, user data, usernames and passwords of various accounts, and much more) If you do not contact us, we will publish all the data on the Internet (media), as well as send it to all the controlling organizations in your country, your customers, partners and competitors. PROOFS (screenshots): https://ibb.co/VVs2pWQ https://ibb.co/6mTC5z5 https://ibb.co/fkrPPvX https://ibb.co/rHpTh5S https://ibb.co/4KV5bZY https://ibb.co/njzryN8 https://ibb.co/qRS30cL https://ibb.co/1bwGGHH https://ibb.co/dKbwVVY https://ibb.co/8Nj4QQs https://ibb.co/Csfhmq0 https://ibb.co/tbN2pXn https://ibb.co/6ghqgbN https://ibb.co/TgHvsjc https://ibb.co/rQjXnyp Your personal leak page: %BLOG_URL% On the page you will find examples of files that have been downloaded. The data is preloaded and will be automatically published if you do not pay. After publication, your data will be available for at least 6 months on our tor cdn servers. We are ready: - To provide you the evidence of stolen data - To delete all the stolen data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://dark24zz36xm4y2phwe7yvnkkkkhxionhfrwp67awpb3r3bdcneivoqd.onion/2E84SN8WJ11IAIH947RGEYOYSO4S8DE3I3J16I5AXKUV2X4FZZN93AZ3D87T2E2O When you open our website, put the following data in the input form: Key: PGStAUT3kdpU8soLtb5xwgKhRMRREshkklxUbAhBkaiptbalrsekWY105dm6iW0N4NQ3TOD6cCUix8U9lCuazYuR3OHomM1UsLcyYJW5E3SBKdEn1iwEZE6OhWXQN0yLO3F3YwK9tmZYwqYL58vJMTX6Taq9EbffYrmdsYKOVAi45dFNQ2Q1d2Ydx3ihD8PDeUjxG5pkQZk28CR1HqWnnI1C1M8DslK8gv4bNwOCDheb4LtTIcKr7UbMTwoVa9BsyzMMRzqEcDw6DlG95y0F97LeDZmNSpkak2XwjdCoBIcsKpXLnw3mJgVPqGTe3Ve3IlNDjr47xgYHXtrmv3Ig2hvi5tw9mhj62NiRvttqa8xkQogWpMgtfvzA34xZHJcgJnXHgqyRHWSauckW0NHCHpx2Cs9vY4mPGMVDLUHzBjDSMFVukx2J0Nordou6Z6FDespElDZYiDYhVEe5WzNdVYESu6gpjo8SrKSIzXMBNPOUW3vAY9Wl4GxNL2heVWQUiEOCuttW5eRg9vZg7q7PNNyu4YDQFlyWB3vM62fdTGCup6CNQF7xdjR !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!
URLs

https://ibb.co/VVs2pWQ

https://ibb.co/6mTC5z5

https://ibb.co/fkrPPvX

https://ibb.co/rHpTh5S

https://ibb.co/4KV5bZY

https://ibb.co/njzryN8

https://ibb.co/qRS30cL

https://ibb.co/1bwGGHH

https://ibb.co/dKbwVVY

https://ibb.co/8Nj4QQs

https://ibb.co/Csfhmq0

https://ibb.co/tbN2pXn

https://ibb.co/6ghqgbN

https://ibb.co/TgHvsjc

https://ibb.co/rQjXnyp

http://dark24zz36xm4y2phwe7yvnkkkkhxionhfrwp67awpb3r3bdcneivoqd.onion/2E84SN8WJ11IAIH947RGEYOYSO4S8DE3I3J16I5AXKUV2X4FZZN93AZ3D87T2E2O

Targets

    • Target

      a11cc5051e3a88428db495f6d8e4b6381a1cb3fa5946a525ef5c00bfcb44e210.bin

    • Size

      54KB

    • MD5

      0390938e8a9df14af45e264a128a5bf8

    • SHA1

      f90f83c3dbcbe9b5437316a67a8abe6a101ef4c3

    • SHA256

      a11cc5051e3a88428db495f6d8e4b6381a1cb3fa5946a525ef5c00bfcb44e210

    • SHA512

      c4b8d0d086a7f3c9aa83e2ad5baa36027cd8785878913b7dc0ad698066aaa0f298dec59cb6fb42cf76530c8be9b242bdacfb1253eb02a6ad84a872df4c586e98

    Score
    10/10
    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Impact

Defacement

1
T1491

Tasks