General

  • Target

    6068654964506624.zip

  • Size

    75KB

  • Sample

    210416-m9tmmv9l22

  • MD5

    d0cc1d759166881a2372ded33c8bbbf8

  • SHA1

    3c1fadeba097e195e4ddaeacdf669511e2dc1e38

  • SHA256

    bedfb7fda70c24b31155f1d92a023d770d8049a73cad408f96dcffc94fa2278a

  • SHA512

    0945d6869ff3859d240c3d3175978114ac9b8fbb4622bb4e280bfa4426d36ea098a564ad7c52a8c5f01db6477cabbf1e286757df4bf589a9bb26c46d81b5c1b7

Score
10/10

Malware Config

Extracted

Path

C:\GANGBANG-NOTE.txt

Ransom Note
Two things have happened to your company. ========================================================================================================================== Gigabytes of archived files that we deemed valuable or sensitive were downloaded from your network to a secure location. When you contact us we will tell you how much data was downloaded and can provide extensive proof of the data extraction. You can analyze the type of the data we download on our websites. If you do not contact us we will start leaking the data periodically in parts. ========================================================================================================================== We have also encrypted files on your computers with military grade algorithms. If you don't have extensive backups the only way to retrieve your data is with our software. Restoration of your data with our software requires a private key which only we possess. ========================================================================================================================== To confirm that our decryption software works send 2 encrypted files from random computers to us via email. You will receive further instructions after you send us the test files. We will make sure you retrieve your data swiftly and securely and your data that we downloaded will be securely deleted when our demands are met. If we do not come to an agreement your data will be leaked on this website. Website: http://corpleaks.net TOR link: http://hxt254aygrsziejn.onion Contact us via email: Jeremyspineberg11@tutanota.com GeromeSkinggagard1999@tutanota.com Jeremyspineberg11@protonmail.com
Emails

Jeremyspineberg11@tutanota.com

GeromeSkinggagard1999@tutanota.com

Jeremyspineberg11@protonmail.com

URLs

http://corpleaks.net

http://hxt254aygrsziejn.onion

Targets

    • Target

      2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21

    • Size

      125KB

    • MD5

      173ab5a59490ea2f66fe37c5e20e05b8

    • SHA1

      ac091ce1281a16f9d7766a7853108c612f058c09

    • SHA256

      2e434bd96b08293786cd010883adfeacce5a30f5743d89c5187f38966b2e5d21

    • SHA512

      0e0d2480fb1bcef185a91d49eb49116dd0fc1837fe634d69451adbdfca00e157495590a59d14409073b0b8b5c96ff3a7f34a7f29976e8fa6cd5aa0b8eedeb05e

    Score
    10/10
    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks