General

  • Target

    b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe

  • Size

    169KB

  • Sample

    210414-yp66hntkb6

  • MD5

    98562209465bec53327e65649a2b8829

  • SHA1

    3a47656ed3df213bd934aa01078a863568fe9f2b

  • SHA256

    b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe

  • SHA512

    c11ce14f9cb75df2bc9bd81971c1f8fa885815715f389eb8e796e0f657de59756b36a6f896c216a03c7be7bb3ddff9b8a47aee71146760e4f4d9c6bdc0ff2cc3

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\!!Read_Me.C722E.html

Ransom Note
#ALL YOUR FILES ARE ENCRYPTED AND STOLEN BY RAGNAROK Dear Sir Your files are encrypted with RSA4096 and AES encryption algorithm. But don't worry, you can return all your files!! follow the instructions to recover your files Cooperate with us and get the decrypter program as soon as possible will be your best solution. Only our software can decrypt all your encrypted files. What guarantees you have? We take our reputation seriously. We reject any form of deceptionYou can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain any valuable information. When hiring third-party negotiators or recovery companies. listen to what they tell you. try to think. Are they really interested in solving your problems or are they just thinking about their profit and ambitions? By the way.We have stolen lots of your company and your private data which includes doc,xls,pdf,jpg,mdf,sql,pst... Here we upload sample files of your company and your private data on our blog : http://wobpitin77vdsdiswr43duntv6eqw4rvphedutpaxycjdie6gg3binad.onion We promise that if you don't pay within a week, we will package and publish all of your company and your data on our website. We also promise we can decrypt all of your data and delete all your files on internet after your payment. Such leaks of information lead to losses for the company. fines and lawsuits. And don't forget that information can fall into the hands of competitors! For us this is just business and to prove to you our seriousness. Our e-mail: dayt0na@tutanota.com Reserve e-mail: daytona@cock.lu potts@secmail.pro Device ID: ==AAA8FMy4CMucjLwEDLP5UTZtkQS1EL0QDM3YkNycjMDZUR3UkRxEURBVEOzAzM5EEMwMUQwQjRGZER5EzMBJUMEFTM5AjNGlTRzQUO0UTMxADMzYDN4YDOxkjQzMzMEVERBNjNFlDMGdDN1QzMyADMxgzNzEUODlzQ2Q0N4AzNENkMyADRxUkN3UkQyUTRxQDNzEjR1cDNCRjNyQTQwUUR0ITR0MkQCJTO2IjQ4IkMwMERCJUN0kzQwATNBRkQ1EkQzIERzgDOBNEREdzMxkTN3IUR3AjR4EjR3cjMDZDRwMDRGVDO4MjR2kTQBBDNGRTQ0IEM2UUQ0gzQ5czM3UkNEJjR4YjMyIDO3U0MwQUMDNEN1MDN3gTQ4QUQ4EkNGNEREFURyATQ2ITOCFURCZTRzUUQ2MkNClDOzEkNzU0N5Q0N4IjR1EUNCN0QwIjQwUTM1EUOElzQFNDN2gTMyMkNGRUMCFTNCdzMCRTM5ADMBVTNzMUOEdzQygzQDN0QyMjRxM0NxUEO0AzQzMkN0UDR0UENFFkRzITM3kjRCVkR2gjNxQERFNjNDF0QyY0N0cDO3IkNEFDODdTO5IkMCdzQwYTM1IENyEkN2EEOyIEM4MTO2MEMERDOxUkM3ADO3MUN1UUOGVENxIUM1UkN2ATRFNkN2EjMzgDRyEUOFNTO1cjNzYjQBR0M2EDR0QjQGRDRBdjMFdTM5gjRwIjMEhjQzE0Q0QTQDRjRFdTQ5EERClzM5ATOBVDO3MEOzYUMFVDRyQUO2AzMyczQwEDO1MTQ5MDMFNTMyIUQ4QkQ1UDRwETN5MkQBBTR0MEO1QjQERUQDNTN0YjR2QUQ1QkQ3gDMCNjM4gjMEBjRxEUQyITQBVUMzIDR1EkMFJkMxMDNxUkRxgzMFR0NwQEO5EjR5cDO1UTOyQER5EDOBN0MxQENwMjQER0Q1UEOygzNwIjR1IkMzQzM1UUOxMzQxQDOBR0NEVkRDRDR1gTM5EUQ3Q0QEFENFR0MyUDNFBDNFZUOzcjRyADOGlTMCBDRCJTR3EDMEJTNClTMwQzQzMDM4gzM1gjRDRjRBNUM5ATOwUENEZkNFJUOzMEM4gDRwIDOEFTOxUDM1kzMzE0QGNENyEzQ2IDOGBjM2YzQEJUOGNTO4kTO5ATR3gzQ4QUMCFTNxUkMzUUMGJDMEZDOEFzMEdjN5QjQxQkN0gTRDZkM0kjRzQzQ5YTRDdDNGNzNCJjRwUjQwI0QDNEMDJEOCFjQGJER2E0NzQTM3QjRDNkR0UjRwAzN5QkQwQEOxAjRDBTN3gTNzYENzEkM3MEO0EDR1I0M0AzMxEkM4kDMGVTN2EkQyUzQ1UENyMkNwQTNFVjMxcTQElzMzYUOwYDN2EzQ4EEMGNDOEF0Q1wSOwcjR3kzMxYjN2MUMxEjNEJTQwUjMDRUREZUM4UEO3AjMzYzQ1QjQ3QERzMEODhjRBJjN5czQwMkN2kDN4EDNChjNDFER0MEM2QTN2IERCBTMyEDN5kTQDZkMBNUMBlTN2QTOCJjMBVENxMjREVEMDFTNyEjN5EUNCNDN0MDOFdDRyETQ2UEM4cjNGZUQFJ0QERjQFZ0QxIDNxMzN3QTQ4cTOGNTRzUkQ5YDM2IkN2QjM1E0QxM0N5gzQwUTQycjR4gTQ5IUMDJTOxQTOwcDM2QjR3M0M5UjQwAzMEF0Q5UUO4ITO2cjN3EDRzMENGZUNFZjN4YjM5UUNwkjM2kzMCFENGFUQwI0N1Q0M5ITO2czMBNDNBJzQ1MkM3MDNCBDOzEUNxczMyMzM0IURCVTMDZUNCJzQCZUQxEUQGFTRxQDM1EjN2MzN2EURzY0N0UERBJDM3ATNwQ0M4cjMwcjQ4MjQ5QUQ3YUOBJDOBBjQ0gTQFZUNDR0MBJzNxkjRFFEO5YkR3UjNzITQCREMCFUQ0YkN2ATR1cjM1EURCJzMyU0Q2gjNDZjM0gzQBVURygjN5gzN3ITMyQERChzMBREM0QTMGRjR3AjMBljQGZkNFNkQ4AzQBVjM1QDRwQjQ3ETRycjQ3I0QwMERwETQyYUQ2UUNFhDOEJTM1IjQENDRDRkRzYDN0ETNEBDRGZEM0UURFZUREVkRGlzN4UzMDJEOBdTRyIDRzATR3kDOEN0Q0U0MFlTRBV0MElzN3kTMChjNBFzMyQER2MjRzUTQ1IkQwQkN2UERDFTQGNkRxEzMBJkQ2AzN5YzN1IUN4gjMwgzN5E0N3ITO3IkQ2QDMzMjN5EjMGFUM5kTNBJjRwATM0gTNxQEO2YTRzMENDBDM3QTREVTM1ADNFJEOGVDMChDMCVUMFNkQ5EEMFZENwAzMBdTOFVTOCFkQEFjNGBjN3MUQCljMDZjR4MTM3QTM4gDMwIDREZkQClzNzIzMCBTQEN0QEdzNyI0NERDRGRzQ1UTNBZDOxIURxEkQCJzNCJTRCVkR2ETMBdTO2EzNENjQDVEOFZzQzYERGBzM0EkMyMDN2YUM3QkQyQUQBljQxMkNzcDMDJTMBNUODFTODljQwITNFNENFV0NwkTQ5gTMBVjQ2Y0MxkDMyIjRCNURFVUN3MUOGR0NzYzMEFTRCR0NEJ0NGFzQ5gTRDJkM2QjMzIURBljNzATMBFTODVkNyQDOzMTRFRUR5EzQ3MUMzMUOBRUOwQ0M3EjQwEkMBFEM1AzNFFkN3MDMxMUOFJTRDJERCdTOClTNEhDM5YkQFFkQ0UzM2EERGNUNzUDOBNTR4QjR4UkQ3YER1U0QEVTQFZEM
Emails

dayt0na@tutanota.com

daytona@cock.lu

potts@secmail.pro

URLs

http://wobpitin77vdsdiswr43duntv6eqw4rvphedutpaxycjdie6gg3binad.onion

Targets

    • Target

      b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe

    • Size

      169KB

    • MD5

      98562209465bec53327e65649a2b8829

    • SHA1

      3a47656ed3df213bd934aa01078a863568fe9f2b

    • SHA256

      b5466ce462df16b3a29f22192b1291d70479cacf35bd5e937f35b2567da948fe

    • SHA512

      c11ce14f9cb75df2bc9bd81971c1f8fa885815715f389eb8e796e0f657de59756b36a6f896c216a03c7be7bb3ddff9b8a47aee71146760e4f4d9c6bdc0ff2cc3

    • Locky

      Ransomware strain released in 2016, with advanced features like anti-analysis.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies boot configuration data using bcdedit

    • Modifies Windows Firewall

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Deletes itself

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Defense Evasion

File Deletion

2
T1107

Modify Registry

1
T1112

Discovery

Remote System Discovery

1
T1018

Impact

Inhibit System Recovery

3
T1490

Tasks