General

  • Target

    6dd4af7019dba1ff08c306fa73d3069c267c4f3d709ef7e8a5d718dbee7b7e56.exe

  • Size

    65KB

  • Sample

    210419-1q7xbq1dbn

  • MD5

    bff66efddf31e2835e50c778f0c338cd

  • SHA1

    0b0e24bd3b6889b10ea6f77f8ffd19b489da4e2f

  • SHA256

    6dd4af7019dba1ff08c306fa73d3069c267c4f3d709ef7e8a5d718dbee7b7e56

  • SHA512

    0c781af46d4a366a3768faa3fa76e69a1532459a1a521d1048e485ef079c03716214c0c13abab1b2b67504ade3fd2316cdaf681f18129f98b82e92d66c32cdec

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-2455352368-1077083310-2879168483-1000\HOW TO DECRYPT FILES.txt

Ransom Note
your network has been infected due to improper browsing with infected html :( * all data has been locked with a unique key and has become .btCry_zip :( * without the unique key, it is impossible to bring your data to the state of origin :( * with the exclusive key in hand, it takes 20 minutes to unlock your data :) * you can get this key for just a fee. contact us email: [email protected] send id along with email id-67588824752785452767452345237499285 PS: * do not rename or change the extension of the files, as this will corrupt the renamed file : ( * no need to format or reinstall Windows :) * do not post this message on a third party website, as they will block the only contact email :( as proof of trust send me a file of up to 1 mb which i will return to you in its original state :)))) contact us until 04/13/2021

Targets

    • Target

      6dd4af7019dba1ff08c306fa73d3069c267c4f3d709ef7e8a5d718dbee7b7e56.exe

    • Size

      65KB

    • MD5

      bff66efddf31e2835e50c778f0c338cd

    • SHA1

      0b0e24bd3b6889b10ea6f77f8ffd19b489da4e2f

    • SHA256

      6dd4af7019dba1ff08c306fa73d3069c267c4f3d709ef7e8a5d718dbee7b7e56

    • SHA512

      0c781af46d4a366a3768faa3fa76e69a1532459a1a521d1048e485ef079c03716214c0c13abab1b2b67504ade3fd2316cdaf681f18129f98b82e92d66c32cdec

    • Drops file in Drivers directory

    • Modifies Installed Components in the registry

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

2
T1060

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Tasks