Overview

overview

10

Static

static

Gr_rs.exe

windows7_x64

10

Gr_rs.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Gr_rs.exe

  • Size

    678KB

  • Sample

    210415-7h1whrvm16

  • MD5

    7684408e648ed2c462817083cd61d6d5

  • SHA1

    8dc1ba94b3b2996dcf45aa2b73730ff636fbed2e

  • SHA256

    b0f6d7c7a168f77b93aa42d7dc22a0118f98f525c14272467ff37c34217417d9

  • SHA512

    00224011cae9e86fac9f394b52b5267166f3bfc6ac6fe34594aaebd53c74f64f716bebdf1e9ad30072d0f800e22680597b766aca8dcc0d57c9f43d39092b7f55

Score
10/10
evasionransomwarespywarestealertrojan

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\Recovery_Instructions.html

Family

medusalocker

Ransom Note
Your personal ID: E28F58269F7FEDAE9CB8EECDE2D55A225AEB354675A3C304BDC118709A2B6F06B22A904B69F139AF2B24FD11994DA2CFC0A5FE8DA91DBA519B40CBB36DA2AE32 53681ACE6D035F4BE96BA9E17A4EFCE7F5BBDB392F67C6326F561F59C18D9C22672A68BE1CC3B22DC36A29D9613B3CE857520E7CEB3E2348719D71A67118 8A3E9A4C079252076D7AF53B1C298AE475188903809B1F2F49D2CB883C7E5E96AF6486402EC259877170527BC618AB0EE6487B89446E3791A942CF8FCC8F 40E15359EC0BABAB478E4EEC3FF381A1127835DCB69FEB8A357CC2B1E7FC943B571C60A1DA3A74D053B172DB0489CB7D8040BC56BC079CA13BEBD35D90FD C1E3C79EA91AEB9F2EDA87E3BE9138F7E48E6E629EAE72B2A13295E97324C4EE2863C787B7AB35AB14D208055F3FDFC8C556ED66104A04C31186374C9E4D F2B28B0F3514FB627816DED19AE195CAC0FAB7AD95B1A8D5FEC1BC5CE51C720A34D7F84343F7B04440B088E10C8C24C5242D59C2534941859B84E598BFD6 B72965260DD36ACC9165CE18758813BB559651B9EDE190B3EC2FF1A58E79B2BFC76D26C01FF2A26E5398B5AA4266B01357614A926A4466AA17FD6BBC5D1F F2EFE002AE32597A35FD65DA78179E7738ADE4C7DBD70A3F4DD19C365BFDD9B400063FA24E5F3A4DAB764DF695F7CAC8BF67DB9258AE00B5C06C9CBB3A82 4E5E5AAACBFB005F5A21F2890C19 /!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\ All your important files have been encrypted! Your files are safe! Only modified. (RSA+AES) ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. No software available on internet can help you. We are the only ones able to solve your problem. We gathered highly confidential/personal data. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you decide to not pay, we will release your data to public or re-seller. So you can expect your data to be publicly available in the near future.. We only seek money and our goal is not to damage your reputation or prevent your business from running. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. Contact us for price and get decryption software. http://gvlay6u4g53rxdi5.onion/8-Ww5sCBhsL8eM4PeAgsfgfa9lrqa81r31-c5EO4jlAOS7D8NCgbfZhNaL4wpxKeGEy * Note that this server is available via Tor browser only Follow the instructions to open the link: 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site. 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it. 3. Now you have Tor browser. In the Tor Browser open "{{URL}}". 4. Start a chat and follow the further instructions. If you can not use the above link, use the email: support@imfoodst.com support@securycasts.com * To contact us, create a new mail on the site: protonmail.com Make contact as soon as possible. Your private key (decryption key) is only stored temporarily. IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.
Emails

support@imfoodst.com support@securycasts.com

URLs

http://gvlay6u4g53rxdi5.onion/8-Ww5sCBhsL8eM4PeAgsfgfa9lrqa81r31-c5EO4jlAOS7D8NCgbfZhNaL4wpxKeGEy

Targets

    • Target

      Gr_rs.exe

    • Size

      678KB

    • MD5

      7684408e648ed2c462817083cd61d6d5

    • SHA1

      8dc1ba94b3b2996dcf45aa2b73730ff636fbed2e

    • SHA256

      b0f6d7c7a168f77b93aa42d7dc22a0118f98f525c14272467ff37c34217417d9

    • SHA512

      00224011cae9e86fac9f394b52b5267166f3bfc6ac6fe34594aaebd53c74f64f716bebdf1e9ad30072d0f800e22680597b766aca8dcc0d57c9f43d39092b7f55

    Score
    10/10
    evasionransomwarespywarestealertrojan

    • UAC bypass

      evasiontrojan

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Modify Registry

3
T1112

File Deletion

2
T1107

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

3
T1082

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Tasks