General

  • Target

    8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.bin.sample.gz

  • Size

    142KB

  • Sample

    210517-wmjbrrz92x

  • MD5

    af81e1a18c356279ccf300154a193926

  • SHA1

    9724eee2a607e8a43834dd48df7f33467f00860e

  • SHA256

    d10d3e09e1f93ccc06ccaa71c4b5e2bacaae2074024ffa7345362c01479ff5a8

  • SHA512

    a86dfd57f8f9c90c55c08d92fcb7f9ea7c6ef4619debe2e52a55e0df554b68b5359798e5bf9ca9aabafd648a52b5f2a07eda627d76970d216894eb687e53e822

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Ransom Note
YOUR COMPANY NETWORK HAS BEEN HACKED All your important files have been encrypted! Your files are safe! Only modified.(AES) No software available on internet can help you. We are the only ones able to decrypt your files. -------------------------------------------------------------------------------- We also gathered highly confidential/personal data. These data are currently stored on a private server. Files are also encrypted and stored securely. -------------------------------------------------------------------------------- As a result of working with us, you will receive: Fully automatic decryptor, all your data will be recovered within a few hours after it's run. Server with your data will be immediately destroyed after your payment. Save time and continue working. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. -------------------------------------------------------------------------------- !!!!!!!!!!!!!!!!!!!!!!!! If you decide not to work with us: All data on your computers will remain encrypted forever. YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER! So you can expect your data to be publicly available in the near future.. The price will increase over time. !!!!!!!!!!!!!!!!!!!!!!!!! -------------------------------------------------------------------------------- It doesn't matter to us what you choose pay us or we will sell your data. We only seek money and our goal is not to damage your reputation or prevent your business from running. Write to us now and we will provide the best prices. Instructions for contacting us: ____________________________________________________________________________________ You have two ways: 1) [Recommended] Using a TOR browser! a. Download and install TOR browser from this site: https://torproject.org/ b. Open the Tor browser. Copy the link: http://promethw27cbrcot.onion/ticket.php?track=141-5D9-Y454 and paste it in the Tor browser. c. Start a chat and follow the further instructions. 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a. Open your any browser (Chrome, Firefox, Opera, IE, Edge) b. Open our secondary website: http://prometheusdec.in/ticket.php?track=141-5D9-Y454 c. Start a chat and follow the further instructions. Warning: secondary website can be blocked, thats why first variant much better and more available. _____________________________________________________________________________________ Attention! Any attempt to restore your files with third-party software will corrupt it. Modify or rename files will result in a loose of data. If you decide to try anyway, make copies before that Key Identifier: WMl+7qUDjFv06R+4Mn7wwRJLGABA4jRM63Eg8mMaP99z916bHvzrYk2sot6W1lYms4v1oQzKbKTDq+ZUf5rEblB9s1IWiKyRiI+zju4zTnRki8Qy3W/MqsTfc57aLL2GSaQMPSc40mWHrmGspTd8eUxEx1ZZ1zTm161WXpo0OCWinHSg2UEBVurMP+NqQdL4fg+A7jtEWDscl3ozoyWdAvQteTeubBeNyhQ/mvvADBCsPiLCuqURz7ofX6yIc6Y0JmdwFVe8e8wEE0ClGQ5tjlW55u0JEOn9BNbRrsZEGLsxlL5b6zsNJoOKR6tyrRI9Km0TwoE90PeO7GAQd1vAS+Zo6MosArYKVVE0M/RbZ5XxpUu+ejA/2mQep2ecEZkhfps9Y2gRGvzTKdxqFjQGR2T1ywZdLx3k99zfdijoqrsX6yx/z6f4u613ghLrr+rJ5eH/0UnWZQYeaIE58PNEZ3pZb8kmwHsFdwtlgOEOsIAsia12YsPMjKsN2bKQCI0h3sZwEQFVAv0maNPcJ0ZWkSrOwpbAj2CsQ+r91RI5/TpYOkfe5mM0fSA6bWA8C3lvj+jypT6HUcaXgZ/FXG/XJAULAaG2xxZ5kFuELSM//bf4CPrmfUVPLyTQ7VaZLvAttrIRQprsA4K5Oa3S8+iKmee5H15h/T/TS0BH0DRC23Q=
URLs

http://promethw27cbrcot.onion/ticket.php?track=141-5D9-Y454

http://prometheusdec.in/ticket.php?track=141-5D9-Y454

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

Ransom Note
YOUR COMPANY NETWORK HAS BEEN HACKED All your important files have been encrypted! Your files are safe! Only modified.(AES) No software available on internet can help you. We are the only ones able to decrypt your files. We also gathered highly confidential/personal data. These data are currently stored on a private server. Files are also encrypted and stored securely. As a result of working with us, you will receive: Fully automatic decryptor, all your data will be recovered within a few hours after it’s installation. Server with your data will be immediately destroyed after your payment. Save time and continue working. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. If you decide not to work with us: All data on your computers will remain encrypted forever. YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER! So you can expect your data to be publicly available in the near future.. The price will increase over time. It doesn't matter to us what you choose pay us or we will sell your data. We only seek money and our goal is not to damage your reputation or prevent your business from running. Write to us now and we will provide the best prices. Instructions for contacting us: You have two ways: 1) [Recommended] Using a TOR browser! a. Download and install TOR browser from this site: https://torproject.org/ b. Open the Tor browser. Copy the link: http://promethw27cbrcot.onion/ticket.php?track=141-5D9-Y454 and paste it in the Tor browser. c. Start a chat and follow the further instructions. 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a. Open your any browser (Chrome, Firefox, Opera, IE, Edge) b. Open our secondary website: http://prometheusdec.in/ticket.php?track=141-5D9-Y454 c. Start a chat and follow the further instructions. Warning: secondary website can be blocked, thats why first variant much better and more available. Attention! Any attempt to restore your files with third-party software will corrupt it. Modify or rename files will result in a loose of data. If you decide to try anyway, make copies before that Key Identifier: WMl+7qUDjFv06R+4Mn7wwRJLGABA4jRM63Eg8mMaP99z916bHvzrYk2sot6W1lYms4v1oQzKbKTDq+ZUf5rEblB9s1IWiKyRiI+zju4zTnRki8Qy3W/MqsTfc57aLL2GSaQMPSc40mWHrmGspTd8eUxEx1ZZ1zTm161WXpo0OCWinHSg2UEBVurMP+NqQdL4fg+A7jtEWDscl3ozoyWdAvQteTeubBeNyhQ/mvvADBCsPiLCuqURz7ofX6yIc6Y0JmdwFVe8e8wEE0ClGQ5tjlW55u0JEOn9BNbRrsZEGLsxlL5b6zsNJoOKR6tyrRI9Km0TwoE90PeO7GAQd1vAS+Zo6MosArYKVVE0M/RbZ5XxpUu+ejA/2mQep2ecEZkhfps9Y2gRGvzTKdxqFjQGR2T1ywZdLx3k99zfdijoqrsX6yx/z6f4u613ghLrr+rJ5eH/0UnWZQYeaIE58PNEZ3pZb8kmwHsFdwtlgOEOsIAsia12YsPMjKsN2bKQCI0h3sZwEQFVAv0maNPcJ0ZWkSrOwpbAj2CsQ+r91RI5/TpYOkfe5mM0fSA6bWA8C3lvj+jypT6HUcaXgZ/FXG/XJAULAaG2xxZ5kFuELSM//bf4CPrmfUVPLyTQ7VaZLvAttrIRQprsA4K5Oa3S8+iKmee5H15h/T/TS0BH0DRC23Q=
URLs

http://promethw27cbrcot.onion/ticket.php?track=141-5D9-Y454

http://prometheusdec.in/ticket.php?track=141-5D9-Y454

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Ransom Note
YOUR COMPANY NETWORK HAS BEEN HACKED All your important files have been encrypted! Your files are safe! Only modified.(AES) No software available on internet can help you. We are the only ones able to decrypt your files. -------------------------------------------------------------------------------- We also gathered highly confidential/personal data. These data are currently stored on a private server. Files are also encrypted and stored securely. -------------------------------------------------------------------------------- As a result of working with us, you will receive: Fully automatic decryptor, all your data will be recovered within a few hours after it's run. Server with your data will be immediately destroyed after your payment. Save time and continue working. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. -------------------------------------------------------------------------------- !!!!!!!!!!!!!!!!!!!!!!!! If you decide not to work with us: All data on your computers will remain encrypted forever. YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER! So you can expect your data to be publicly available in the near future.. The price will increase over time. !!!!!!!!!!!!!!!!!!!!!!!!! -------------------------------------------------------------------------------- It doesn't matter to us what you choose pay us or we will sell your data. We only seek money and our goal is not to damage your reputation or prevent your business from running. Write to us now and we will provide the best prices. Instructions for contacting us: ____________________________________________________________________________________ You have two ways: 1) [Recommended] Using a TOR browser! a. Download and install TOR browser from this site: https://torproject.org/ b. Open the Tor browser. Copy the link: http://promethw27cbrcot.onion/ticket.php?track=141-5D9-Y454 and paste it in the Tor browser. c. Start a chat and follow the further instructions. 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a. Open your any browser (Chrome, Firefox, Opera, IE, Edge) b. Open our secondary website: http://prometheusdec.in/ticket.php?track=141-5D9-Y454 c. Start a chat and follow the further instructions. Warning: secondary website can be blocked, thats why first variant much better and more available. _____________________________________________________________________________________ Attention! Any attempt to restore your files with third-party software will corrupt it. Modify or rename files will result in a loose of data. If you decide to try anyway, make copies before that Key Identifier: pP4e5LxGe5yVfk/UP/5ZYSMVY/kzKfljeslWL5+jsSun78Le/U/bBLtpsTWvgnt0cuzMPQbi4Rfwhb2ghwSS4hLngOHhUMyYjtE8fsWtLNdDaiNQTcybs+0rdEEU3ZstU5YDxFtTb13Q7zJB7w13Tav0WEgiQ2M8r/3uXapW31rgyWMe4cF4Uxe3Zffb6dw4Id35YXXft0CmjRHiNdwJkKzSlsWU9RafxJcnERVo8F45wmJxGpUfgOhYNrR7GzKg95HqzID6XNDpANmyqHFnTCNkIyVq/7JvWEH+mu/o9rFTeHrOMdtWnRi4ddheWTVogzJuqAm+MrxPooas6KA17Vk/V4qj/IaTuMdXTvIm2ol4+59GBILfFhtc9MJ1hpyWT+HTVorYeTlijK24y7TVImfJuLWMi+lQZt2f94cEJ4u2uNjh4vZvKU5p8GgNArkCGdrJymatUgbADjAzUF1jWh3GJXkrDlXSpRHi3t5jY+eyKPYXMxpK4sYl0bXPba/ClUErOk4uYvAtPNAPUjfr0uaVZEv3L+MT0USl4TTjNQ/q3iq+J+q4dw6aVkuNWHdIAqrWUS2dORmLtmOTiFyer4JdVOVRt3owSx9wY0BkUDpJBrqgLvlW2zneIpL4ySSd/KjUtbpmiwryz9+Sb99kgYBuL21wDiiGTAUCtKka9zw=
URLs

http://promethw27cbrcot.onion/ticket.php?track=141-5D9-Y454

http://prometheusdec.in/ticket.php?track=141-5D9-Y454

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta

Ransom Note
YOUR COMPANY NETWORK HAS BEEN HACKED All your important files have been encrypted! Your files are safe! Only modified.(AES) No software available on internet can help you. We are the only ones able to decrypt your files. We also gathered highly confidential/personal data. These data are currently stored on a private server. Files are also encrypted and stored securely. As a result of working with us, you will receive: Fully automatic decryptor, all your data will be recovered within a few hours after it’s installation. Server with your data will be immediately destroyed after your payment. Save time and continue working. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back. If you decide not to work with us: All data on your computers will remain encrypted forever. YOUR DATA ON OUR SERVER AND WE WILL RELEASE YOUR DATA TO PUBLIC OR RE-SELLER! So you can expect your data to be publicly available in the near future.. The price will increase over time. It doesn't matter to us what you choose pay us or we will sell your data. We only seek money and our goal is not to damage your reputation or prevent your business from running. Write to us now and we will provide the best prices. Instructions for contacting us: You have two ways: 1) [Recommended] Using a TOR browser! a. Download and install TOR browser from this site: https://torproject.org/ b. Open the Tor browser. Copy the link: http://promethw27cbrcot.onion/ticket.php?track=141-5D9-Y454 and paste it in the Tor browser. c. Start a chat and follow the further instructions. 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a. Open your any browser (Chrome, Firefox, Opera, IE, Edge) b. Open our secondary website: http://prometheusdec.in/ticket.php?track=141-5D9-Y454 c. Start a chat and follow the further instructions. Warning: secondary website can be blocked, thats why first variant much better and more available. Attention! Any attempt to restore your files with third-party software will corrupt it. Modify or rename files will result in a loose of data. If you decide to try anyway, make copies before that Key Identifier: pP4e5LxGe5yVfk/UP/5ZYSMVY/kzKfljeslWL5+jsSun78Le/U/bBLtpsTWvgnt0cuzMPQbi4Rfwhb2ghwSS4hLngOHhUMyYjtE8fsWtLNdDaiNQTcybs+0rdEEU3ZstU5YDxFtTb13Q7zJB7w13Tav0WEgiQ2M8r/3uXapW31rgyWMe4cF4Uxe3Zffb6dw4Id35YXXft0CmjRHiNdwJkKzSlsWU9RafxJcnERVo8F45wmJxGpUfgOhYNrR7GzKg95HqzID6XNDpANmyqHFnTCNkIyVq/7JvWEH+mu/o9rFTeHrOMdtWnRi4ddheWTVogzJuqAm+MrxPooas6KA17Vk/V4qj/IaTuMdXTvIm2ol4+59GBILfFhtc9MJ1hpyWT+HTVorYeTlijK24y7TVImfJuLWMi+lQZt2f94cEJ4u2uNjh4vZvKU5p8GgNArkCGdrJymatUgbADjAzUF1jWh3GJXkrDlXSpRHi3t5jY+eyKPYXMxpK4sYl0bXPba/ClUErOk4uYvAtPNAPUjfr0uaVZEv3L+MT0USl4TTjNQ/q3iq+J+q4dw6aVkuNWHdIAqrWUS2dORmLtmOTiFyer4JdVOVRt3owSx9wY0BkUDpJBrqgLvlW2zneIpL4ySSd/KjUtbpmiwryz9+Sb99kgYBuL21wDiiGTAUCtKka9zw=
URLs

http://promethw27cbrcot.onion/ticket.php?track=141-5D9-Y454

http://prometheusdec.in/ticket.php?track=141-5D9-Y454

Targets

    • Target

      sample

    • Size

      142KB

    • MD5

      e1f063d63a75e0e0e864052b1a50ab06

    • SHA1

      75d941a28cf0ade2ef2c16dfacbdeb36a51ccaf7

    • SHA256

      8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7

    • SHA512

      25681b210ee18bd60ba3fef496769283d51dc516569e1f1834d6d23a5927c1684b25ff67baf5fba66c908b364a13784f49facdde7a98b2fb8a8a41a2ec792ae3

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Deletes itself

    • Drops startup file

    • Loads dropped DLL

    • Modifies WinLogon

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Winlogon Helper DLL

1
T1004

Defense Evasion

Modify Registry

4
T1112

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Tasks