General

  • Target

    db9f5ce9c4bc12ba9769c3f53c5c4c8168faba4cbd5d0119ea99e2db07c1d9bb

  • Size

    719KB

  • Sample

    210528-7zy57v7ede

  • MD5

    456e570841e33662dc1e07fa3cc9f1fe

  • SHA1

    271c0abc2698b7bd197dd9a0c9630299849de767

  • SHA256

    db9f5ce9c4bc12ba9769c3f53c5c4c8168faba4cbd5d0119ea99e2db07c1d9bb

  • SHA512

    4dc75f7f892ce7512df44aa35b45b17a79685b36e8ccfc84ae10fe456cafcfd69b64443765a635174a71c8ef162b6b6dca419a7b85d2c20482e2493e48ca91e9

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\KlroT_readme_.txt

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .bEBcbAdaED You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- NTc2LTAzVmFaMVVHU2MvV0s3dFJJYnJHYm5HcTE4blVteVg3OEVkaVRpN0pMWkZDN2huSGlMMElJY1UyQUozNXdZUFNWcE9jZ09ZMTJBMUQwVWVvaTdmQkJjMWVIQXowUm5XRzdCc0lib2tFa0plSjRhWDRacjJnVTJScU9CMm9FYkwyQlYvcHE2Q3NNekRNbkxGWTd6NTRrK3FnalMxb0xnRmFubG5oZk5VdmF5SklRY0ZzUEp2Y3BBakNkb3VDTTgwaDVDNXdMWXIvS1JhK3ZmZUJuMFB1aVhNTWNKb1cwSlJWRW43aDBLWFoydmwxeHV0U0VZYTYyNUpFOVJWaUlhd1ROOWE5N1JqNnlNMytWUGYwUFRGTmptd0RnSlVJMnBLR0pVd0VRVlhqd01uMXVCWnc3dWhEdXhUL0hJWTlVNERxQklYMHlZZXFReEpkZWRZOG5Wa0xPdWYyOFZjUTQ0citPSkZQb3pRU1ZMZUs3WS9tcjVKczhlMnhFOC9sWUtDbDZGMGg3N0gzOVJveUxpV2NLWThVSXVTTi80TFRhYVZQdkJvVlcwTUVHNWpQMHk3RWc5ZHdUZlVKQVo1bXlLNkxzblAyaUk0STdodm5wVVg5UGlURlUyOXF3YjNiNFNhQVdUY2w5M29kU1VhUFpYeXZFYzhzWG80TnRRRVZJTFpTK2JMR3doeDJlbjZRTHJYNTVBT1A5MEdCOEdVNzZrTlMxdUhKcnFQajE4Y2dJaGtWYWtaYUZlWjgyNW5jSHlFR296UXBqbkJYMWd6YUxFY1NuRmQvVWxUaE51UUR1eFR4ekhINzdFRTc4c2QvNmx1QjZpeldYOVl1aklvZTZGQ2kvRk8zd3ZFRGJuRFdIazdNUHZwbWhxdXp6YnBoaTNQLzNqbWpUUUZrZHVjYlpQZzFTbWpGZWh3KzlGQzFqaWp4cWxyaS9BSmZWdmRicDVjY1JMSjBzbzQ1Z254UW9LWG52RzhOWEp0Rml0c1drZk5LcW4wc2NuQjNtVnp3Y2doSmsraGNwQVV3cXNTelgxS2xoTU5NZHVzVXUwTWl3SUJObzg5UElFaU9rdmhEelZsQUowb0NyZ0x2UWt6NUE4MHZSR2FQelI0SzJ5YjJBcVdENG5jUS93amw1ZzBmdjFHNUlHQW1vSyttUTlHbk5xSHN1WEZjSlJ3N0R2YmFMa0VxZ01yTWZVSHY1S3l6MGNGcmY3bGxxdGhpcTBMMWxHY3Awa0ZmeVRFUzNoWlNaK1JnN1NLYzhPVSs3Tjc5MUtzcytRMldmWkhHYzRCaTA2WE5HMWpGWmVaaWNlcDJ2TDR6Ry94cExGWlBKOWsxdzVHYU1oMHRadVZqd0FvOVgwcGR0QnlzSnNxVys1YkZxdWFiS09KazZTbGtoL2VadTFGdTNIaHRjenRZTlJSL1dLSzNJN2ZtNVB5YkZrbmY0Q3E3Ni9XdXQ5S005OVJqRS9DS2orV040UEtKU3hXYkN2SUhYbU9DNXlEcDlOWklYQjJOM0JtZTBiTloxL2xFazRBQllSQ2VQRWpVUEx6UnpXTzV5YjBpNzZHaDZCZk1LeHRra0crbnNjQWdjMVN0S29ydU95K1pBaGVZU2puZ2NUanpuYVEza0ZXZjBpQlhGQ1lLKyt1QUFoZzV1ZUhacGNoaTNVeXJPZjFwem5yS2M2RVdTZENYMjBFeGhmL1VsTE81QVA0M0h3QUhGZGJVNXRuZEhFaTB6UmJST2N0d2NFNGlIN1ByZERHWVZ6L3lhQWJHSG5ianBiUEx4YnFFRVVhK01ybkZlTXFBSE8wdk5hSXNqQjZTZThRL1FZbVFMWUZMbjJlSlBlV3drR1BlTDZZSlczOGIzcktOM3ZTY2NVcnlZQTlrVVV5ZDBpa2VLWFlaL2Uyd2Q0bUNRaEtxYndBT21EcW1lUTF2RXlKcUx5MzUxSjhjVU9FQVZVOGVtSHppZjFyQS9pcWxRbWthY05PMFMzamFPVFRrZUFGbEFJdVB1V29EOXhvYmt2RmVsWjZSNE04SGtsNUlwNmg3dWxZemo4aU4rc1A1YTkxcFJhbk5nQUhTRUhQMDZWVXRYRjdkWHh6Y0lkdjNXWWc9 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * XVa1dL9n4doJZpQ
URLs

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Downloads\KlroT_readme_.txt

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .bEBcbAdaED You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- NTc2LTAzVmFaMVVHU2MvV0s3dFJJYnJHYm5HcTE4blVteVg3OEVkaVRpN0pMWkZDN2huSGlMMElJY1UyQUozNXdZUFNWcE9jZ09ZMTJBMUQwVWVvaTdmQkJjMWVIQXowUm5XRzdCc0lib2tFa0plSjRhWDRacjJnVTJScU9CMm9FYkwyQlYvcHE2Q3NNekRNbkxGWTd6NTRrK3FnalMxb0xnRmFubG5oZk5VdmF5SklRY0ZzUEp2Y3BBakNkb3VDTTgwaDVDNXdMWXIvS1JhK3ZmZUJuMFB1aVhNTWNKb1cwSlJWRW43aDBLWFoydmwxeHV0U0VZYTYyNUpFOVJWaUlhd1ROOWE5N1JqNnlNMytWUGYwUFRGTmptd0RnSlVJMnBLR0pVd0VRVlhqd01uMXVCWnc3dWhEdXhUL0hJWTlVNERxQklYMHlZZXFReEpkZWRZOG5Wa0xPdWYyOFZjUTQ0citPSkZQb3pRU1ZMZUs3WS9tcjVKczhlMnhFOC9sWUtDbDZGMGg3N0gzOVJveUxpV2NLWThVSXVTTi80TFRhYVZQdkJvVlcwTUVHNWpQMHk3RWc5ZHdUZlVKQVo1bXlLNkxzblAyaUk0STdodm5wVVg5UGlURlUyOXF3YjNiNFNhQVdUY2w5M29kU1VhUFpYeXZFYzhzWG80TnRRRVZJTFpTK2JMR3doeDJlbjZRTHJYNTVBT1A5MEdCOEdVNzZrTlMxdUhKcnFQajE4Y2dJaGtWYWtaYUZlWjgyNW5jSHlFR296UXBqbkJYMWd6YUxFY1NuRmQvVWxUaE51UUR1eFR4ekhINzdFRTc4c2QvNmx1QjZpeldYOVl1aklvZTZGQ2kvRk8zd3ZFRGJuRFdIazdNUHZwbWhxdXp6YnBoaTNQLzNqbWpUUUZrZHVjYlpQZzFTbWpGZWh3KzlGQzFqaWp4cWxyaS9BSmZWdmRicDVjY1JMSjBzbzQ1Z254UW9LWG52RzhOWEp0Rml0c1drZk5LcW4wc2NuQjNtVnp3Y2doSmsraGNwQVV3cXNTelgxS2xoTU5NZHVzVXUwTWl3SUJObzg5UElFaU9rdmhEelZsQUowb0NyZ0x2UWt6NUE4MHZSR2FQelI0SzJ5YjJBcVdENG5jUS93amw1ZzBmdjFHNUlHQW1vSyttUTlHbk5xSHN1WEZjSlJ3N0R2YmFMa0VxZ01yTWZVSHY1S3l6MGNGcmY3bGxxdGhpcTBMMWxHY3Awa0ZmeVRFUzNoWlNaK1JnN1NLYzhPVSs3Tjc5MUtzcytRMldmWkhHYzRCaTA2WE5HMWpGWmVaaWNlcDJ2TDR6Ry94cExGWlBKOWsxdzVHYU1oMHRadVZqd0FvOVgwcGR0QnlzSnNxVys1YkZxdWFiS09KazZTbGtoL2VadTFGdTNIaHRjenRZTlJSL1dLSzNJN2ZtNVB5YkZrbmY0Q3E3Ni9XdXQ5S005OVJqRS9DS2orV040UEtKU3hXYkN2SUhYbU9DNXlEcDlOWklYQjJOM0JtZTBiTloxL2xFazRBQllSQ2VQRWpVUEx6UnpXTzV5YjBpNzZHaDZCZk1LeHRra0crbnNjQWdjMVN0S29ydU95K1pBaGVZU2puZ2NUanpuYVEza0ZXZjBpQlhGQ1lLKyt1QUFoZzV1ZUhacGNoaTNVeXJPZjFwem5yS2M2RVdTZENYMjBFeGhmL1VsTE81QVA0M0h3QUhGZGJVNXRuZEhFaTB6UmJST2N0d2NFNGlIN1ByZERHWVZ6L3lhQWJHSG5ianBiUEx4YnFFRVVhK01ybkZlTXFBSE8wdk5hSXNqQjZTZThRL1FZbVFMWUZMbjJlSlBlV3drR1BlTDZZSlczOGIzcktOM3ZTY2NVcnlZQTlrVVV5ZDBpa2VLWFlaL2Uyd2Q0bUNRaEtxYndBT21EcW1lUTF2RXlKcUx5MzUxSjhjVU9FQVZVOGVtSHppZjFyQS9pcWxRbWthY05PMFMzamFPVFRrZUFGbEFJdVB1V29EOXhvYmt2RmVsWjZSNE04SGtsNUlwNmg3dWxZemo4aU4rc1A1YTkxcFJhbk5nQUhTRUhQMDZWVXRYRjdkWHh6Y0lkdjNXWWc9 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * tdBOy2wbuGWORl4luu
URLs

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Default\KlroT_readme_.txt

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .bEBcbAdaED You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- NTc2LTAzVmFaMVVHU2MvV0s3dFJJYnJHYm5HcTE4blVteVg3OEVkaVRpN0pMWkZDN2huSGlMMElJY1UyQUozNXdZUFNWcE9jZ09ZMTJBMUQwVWVvaTdmQkJjMWVIQXowUm5XRzdCc0lib2tFa0plSjRhWDRacjJnVTJScU9CMm9FYkwyQlYvcHE2Q3NNekRNbkxGWTd6NTRrK3FnalMxb0xnRmFubG5oZk5VdmF5SklRY0ZzUEp2Y3BBakNkb3VDTTgwaDVDNXdMWXIvS1JhK3ZmZUJuMFB1aVhNTWNKb1cwSlJWRW43aDBLWFoydmwxeHV0U0VZYTYyNUpFOVJWaUlhd1ROOWE5N1JqNnlNMytWUGYwUFRGTmptd0RnSlVJMnBLR0pVd0VRVlhqd01uMXVCWnc3dWhEdXhUL0hJWTlVNERxQklYMHlZZXFReEpkZWRZOG5Wa0xPdWYyOFZjUTQ0citPSkZQb3pRU1ZMZUs3WS9tcjVKczhlMnhFOC9sWUtDbDZGMGg3N0gzOVJveUxpV2NLWThVSXVTTi80TFRhYVZQdkJvVlcwTUVHNWpQMHk3RWc5ZHdUZlVKQVo1bXlLNkxzblAyaUk0STdodm5wVVg5UGlURlUyOXF3YjNiNFNhQVdUY2w5M29kU1VhUFpYeXZFYzhzWG80TnRRRVZJTFpTK2JMR3doeDJlbjZRTHJYNTVBT1A5MEdCOEdVNzZrTlMxdUhKcnFQajE4Y2dJaGtWYWtaYUZlWjgyNW5jSHlFR296UXBqbkJYMWd6YUxFY1NuRmQvVWxUaE51UUR1eFR4ekhINzdFRTc4c2QvNmx1QjZpeldYOVl1aklvZTZGQ2kvRk8zd3ZFRGJuRFdIazdNUHZwbWhxdXp6YnBoaTNQLzNqbWpUUUZrZHVjYlpQZzFTbWpGZWh3KzlGQzFqaWp4cWxyaS9BSmZWdmRicDVjY1JMSjBzbzQ1Z254UW9LWG52RzhOWEp0Rml0c1drZk5LcW4wc2NuQjNtVnp3Y2doSmsraGNwQVV3cXNTelgxS2xoTU5NZHVzVXUwTWl3SUJObzg5UElFaU9rdmhEelZsQUowb0NyZ0x2UWt6NUE4MHZSR2FQelI0SzJ5YjJBcVdENG5jUS93amw1ZzBmdjFHNUlHQW1vSyttUTlHbk5xSHN1WEZjSlJ3N0R2YmFMa0VxZ01yTWZVSHY1S3l6MGNGcmY3bGxxdGhpcTBMMWxHY3Awa0ZmeVRFUzNoWlNaK1JnN1NLYzhPVSs3Tjc5MUtzcytRMldmWkhHYzRCaTA2WE5HMWpGWmVaaWNlcDJ2TDR6Ry94cExGWlBKOWsxdzVHYU1oMHRadVZqd0FvOVgwcGR0QnlzSnNxVys1YkZxdWFiS09KazZTbGtoL2VadTFGdTNIaHRjenRZTlJSL1dLSzNJN2ZtNVB5YkZrbmY0Q3E3Ni9XdXQ5S005OVJqRS9DS2orV040UEtKU3hXYkN2SUhYbU9DNXlEcDlOWklYQjJOM0JtZTBiTloxL2xFazRBQllSQ2VQRWpVUEx6UnpXTzV5YjBpNzZHaDZCZk1LeHRra0crbnNjQWdjMVN0S29ydU95K1pBaGVZU2puZ2NUanpuYVEza0ZXZjBpQlhGQ1lLKyt1QUFoZzV1ZUhacGNoaTNVeXJPZjFwem5yS2M2RVdTZENYMjBFeGhmL1VsTE81QVA0M0h3QUhGZGJVNXRuZEhFaTB6UmJST2N0d2NFNGlIN1ByZERHWVZ6L3lhQWJHSG5ianBiUEx4YnFFRVVhK01ybkZlTXFBSE8wdk5hSXNqQjZTZThRL1FZbVFMWUZMbjJlSlBlV3drR1BlTDZZSlczOGIzcktOM3ZTY2NVcnlZQTlrVVV5ZDBpa2VLWFlaL2Uyd2Q0bUNRaEtxYndBT21EcW1lUTF2RXlKcUx5MzUxSjhjVU9FQVZVOGVtSHppZjFyQS9pcWxRbWthY05PMFMzamFPVFRrZUFGbEFJdVB1V29EOXhvYmt2RmVsWjZSNE04SGtsNUlwNmg3dWxZemo4aU4rc1A1YTkxcFJhbk5nQUhTRUhQMDZWVXRYRjdkWHh6Y0lkdjNXWWc9 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * kFnlIEiuksEwnCCJZRCrW
URLs

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Desktop\t0nyiwa_readme_.txt

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .BEcEdDBDBb You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- NTc2LXZ3N2hqN2ZHaWVlZ0JQM1pXeERlNC9xODNWKzlXNmROcEhhZ0k0dEZseTAwaThTb2h6QkZHcGxidUlrc2pQQkxRQ05Gd2tBZHRETTZ3SmZOaWFnamJoTGxaMElsb1pQNzFzN2gzUy9zNE5MV1FodUtMYmFjaFdIbGR4T1I5bTY3WGVEUllwNWNic0hSL0o2TXpOQ1VnRlM0SGVMMlpHWkpwdENVWjRLN0tITm4vQzdJek5BdWRVNk5saFJ6ODFBa1RGTS9iYzZhbFVQM0psb1h4Wks5WVd5U05LVGdZbzhqUG4zUVpBTHhob1RyMyt1Nkx4UW92QVZmS2psaTlFZGtnaEtWbmVyNENaMEdyZG84WTN3TFFTTzBOZjZhUENVdm9XdjYxL1VNUzdvMzJReU8xSVdEN3RHRTdCcTd2b3lxTFlZRkdMNGRPNHl0dzIrWGJ3bDBsSS96dUpyUU5ESmhJa1pHNGliWUtuYksrU1NCU1RTN2hTZVZHckdJTWQ0ZGlYL2dwVHZKb3R6ZFl5TFN1NkNEL05GdUVXTE9NeEZkOFJ4bDVtN3c0bUhmWWhMbGZob29kSXI3VzBLajhoQ0hZYXM1d1BEZkc2YkdYcVlkdUxmWVFpU2hvc3BBQjFJcTNxODdzUkZSeE4zUEZkYkJTRjFISFRhdDlZUVkrYmlwOHJOQmtQOG95NG1LSFNBekdYVFFDNUpkRWJiNHRSclB2SjRSVDZYSys3a1pJVmFMTFJDRENFTG1BM1FSSzkrMmtDL2N2cXdCamhXT3pZRlpWYjFsb1pVSnJWS3JNOHBYOVdvZU52VmRJUkxIZGJ1Mm54ZnpKSktSNkNZR21yN1kwdmsrTDFZNk5oT2daemV5RlY4c2EzMkdGZ1F1dGtRZXF1ZGdtOWF1bytEbXJXTGhkRWdWbmN5Tk1QK0VkOVdZWkR2aDdKWUQ4ZEREaWNseXJVaUdqeW93S2pYYnF4MVdJMS8yN0tDcVhJLzhEcXV6OFlPaEhxTWxucUdLNGozVGtnQ0JoUlQrdlVaM2RWdENYbDF1ZGtIaEZMRXBJZTB6cDUvQXJwN2N6WCt1Q2FER0FhL0lCV3ZLUER5bldDYUxNVzc2NkkxcThhcUlJUlM2K0cwYVBFQmtQN0YrQkV5eEdUNnVsV0JOQ25tMm0wVHE4eVdHazY2dUJobkVtOWFsa3JIUno4eGZQbEFlUC9XRVQ2WWNrbUFkSitJUmx1TnNvY3hOei9aaTZlS2ZlQnM3Qy9wODgzU2Z1Uk5BeDdvMW4zRjcySmoyMWJSOFp1anFoVmlJNGdKemdkRUhUTUFSMXQxancrZVhsM0Y0RXFNa1MvNlBtNzk0ZWIxaWt4M1YyZXBTOGlkalR1QXRSNU8xbmg2Q0tOV1ZrZVBIY0xjaVFtd1NpZ3BBbEFEZnc2RFNPbFR4MWt3RXJiOHJNd3VYU0ZPbmRwaUtuc3R5T0Nudk1ZckRYZ1d2d2N3anVUR3k5bFZlMjUwODYyZFFsb3Ywem1EZ0xoRzFDTStVa0kvTTc4bVFUQS9kQmY5S1pQY1hOS0JNUUtuYVphczZTa25yRUJYanIvZTVuTUdnZGtOM2JFb3BRZVVqQ0ltL3VoMk9HQ2h6QTQ3dkprQkFVY1FvY0c4MGxVMlpkZWZOcTlNZUNIMkhMSytYdlZNV2JZbmltUUlRbVI4a1ZOek4rQkZxNVdFdTZRdktFcjZuMUhBY3A3YnRoKzJ1KzBZOHVxbG5WT1hHMDhZWkhPb0hTNXM0UlJ1ejZiQzJvalI2Y3dGMG53VmFxWUFHcWo0T3h6K0RpdDBoZmMxbUp5VStJWWVabWFEK3Vjd09MWktnc1o1eXBTcUpqM09tVTBRZ1BTNWZ5TmlkR1dQTEJUSWRnS3pwN0lDdkt1UnZ6cXhCbVROVTZnMDNLc0RBNlNPUHlFeXhLaWpaTmUzS0owT2lENmZkQy9INUQxY0JzWisyQWk5eEN3VTVSNzVIZDhjQThDc0N2dEZaSEQyeC9pQ2pPY1ZvTWhvbWpXZzcrek1vbzNiMjBJM2tDcHRzM2dqL3I0Q25NVnM1V2JCcXNpWlZsR04xQXkwamFFSHJVZ0E9 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * TM7Xi1w5xYg0v17lFQ1qi
URLs

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\.oracle_jre_usage\t0nyiwa_readme_.txt

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .BEcEdDBDBb You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- NTc2LXZ3N2hqN2ZHaWVlZ0JQM1pXeERlNC9xODNWKzlXNmROcEhhZ0k0dEZseTAwaThTb2h6QkZHcGxidUlrc2pQQkxRQ05Gd2tBZHRETTZ3SmZOaWFnamJoTGxaMElsb1pQNzFzN2gzUy9zNE5MV1FodUtMYmFjaFdIbGR4T1I5bTY3WGVEUllwNWNic0hSL0o2TXpOQ1VnRlM0SGVMMlpHWkpwdENVWjRLN0tITm4vQzdJek5BdWRVNk5saFJ6ODFBa1RGTS9iYzZhbFVQM0psb1h4Wks5WVd5U05LVGdZbzhqUG4zUVpBTHhob1RyMyt1Nkx4UW92QVZmS2psaTlFZGtnaEtWbmVyNENaMEdyZG84WTN3TFFTTzBOZjZhUENVdm9XdjYxL1VNUzdvMzJReU8xSVdEN3RHRTdCcTd2b3lxTFlZRkdMNGRPNHl0dzIrWGJ3bDBsSS96dUpyUU5ESmhJa1pHNGliWUtuYksrU1NCU1RTN2hTZVZHckdJTWQ0ZGlYL2dwVHZKb3R6ZFl5TFN1NkNEL05GdUVXTE9NeEZkOFJ4bDVtN3c0bUhmWWhMbGZob29kSXI3VzBLajhoQ0hZYXM1d1BEZkc2YkdYcVlkdUxmWVFpU2hvc3BBQjFJcTNxODdzUkZSeE4zUEZkYkJTRjFISFRhdDlZUVkrYmlwOHJOQmtQOG95NG1LSFNBekdYVFFDNUpkRWJiNHRSclB2SjRSVDZYSys3a1pJVmFMTFJDRENFTG1BM1FSSzkrMmtDL2N2cXdCamhXT3pZRlpWYjFsb1pVSnJWS3JNOHBYOVdvZU52VmRJUkxIZGJ1Mm54ZnpKSktSNkNZR21yN1kwdmsrTDFZNk5oT2daemV5RlY4c2EzMkdGZ1F1dGtRZXF1ZGdtOWF1bytEbXJXTGhkRWdWbmN5Tk1QK0VkOVdZWkR2aDdKWUQ4ZEREaWNseXJVaUdqeW93S2pYYnF4MVdJMS8yN0tDcVhJLzhEcXV6OFlPaEhxTWxucUdLNGozVGtnQ0JoUlQrdlVaM2RWdENYbDF1ZGtIaEZMRXBJZTB6cDUvQXJwN2N6WCt1Q2FER0FhL0lCV3ZLUER5bldDYUxNVzc2NkkxcThhcUlJUlM2K0cwYVBFQmtQN0YrQkV5eEdUNnVsV0JOQ25tMm0wVHE4eVdHazY2dUJobkVtOWFsa3JIUno4eGZQbEFlUC9XRVQ2WWNrbUFkSitJUmx1TnNvY3hOei9aaTZlS2ZlQnM3Qy9wODgzU2Z1Uk5BeDdvMW4zRjcySmoyMWJSOFp1anFoVmlJNGdKemdkRUhUTUFSMXQxancrZVhsM0Y0RXFNa1MvNlBtNzk0ZWIxaWt4M1YyZXBTOGlkalR1QXRSNU8xbmg2Q0tOV1ZrZVBIY0xjaVFtd1NpZ3BBbEFEZnc2RFNPbFR4MWt3RXJiOHJNd3VYU0ZPbmRwaUtuc3R5T0Nudk1ZckRYZ1d2d2N3anVUR3k5bFZlMjUwODYyZFFsb3Ywem1EZ0xoRzFDTStVa0kvTTc4bVFUQS9kQmY5S1pQY1hOS0JNUUtuYVphczZTa25yRUJYanIvZTVuTUdnZGtOM2JFb3BRZVVqQ0ltL3VoMk9HQ2h6QTQ3dkprQkFVY1FvY0c4MGxVMlpkZWZOcTlNZUNIMkhMSytYdlZNV2JZbmltUUlRbVI4a1ZOek4rQkZxNVdFdTZRdktFcjZuMUhBY3A3YnRoKzJ1KzBZOHVxbG5WT1hHMDhZWkhPb0hTNXM0UlJ1ejZiQzJvalI2Y3dGMG53VmFxWUFHcWo0T3h6K0RpdDBoZmMxbUp5VStJWWVabWFEK3Vjd09MWktnc1o1eXBTcUpqM09tVTBRZ1BTNWZ5TmlkR1dQTEJUSWRnS3pwN0lDdkt1UnZ6cXhCbVROVTZnMDNLc0RBNlNPUHlFeXhLaWpaTmUzS0owT2lENmZkQy9INUQxY0JzWisyQWk5eEN3VTVSNzVIZDhjQThDc0N2dEZaSEQyeC9pQ2pPY1ZvTWhvbWpXZzcrek1vbzNiMjBJM2tDcHRzM2dqL3I0Q25NVnM1V2JCcXNpWlZsR04xQXkwamFFSHJVZ0E9 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * pUju3DjtJAO5HRFnuxwxtLtE
URLs

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Favorites\t0nyiwa_readme_.txt

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .BEcEdDBDBb You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- NTc2LXZ3N2hqN2ZHaWVlZ0JQM1pXeERlNC9xODNWKzlXNmROcEhhZ0k0dEZseTAwaThTb2h6QkZHcGxidUlrc2pQQkxRQ05Gd2tBZHRETTZ3SmZOaWFnamJoTGxaMElsb1pQNzFzN2gzUy9zNE5MV1FodUtMYmFjaFdIbGR4T1I5bTY3WGVEUllwNWNic0hSL0o2TXpOQ1VnRlM0SGVMMlpHWkpwdENVWjRLN0tITm4vQzdJek5BdWRVNk5saFJ6ODFBa1RGTS9iYzZhbFVQM0psb1h4Wks5WVd5U05LVGdZbzhqUG4zUVpBTHhob1RyMyt1Nkx4UW92QVZmS2psaTlFZGtnaEtWbmVyNENaMEdyZG84WTN3TFFTTzBOZjZhUENVdm9XdjYxL1VNUzdvMzJReU8xSVdEN3RHRTdCcTd2b3lxTFlZRkdMNGRPNHl0dzIrWGJ3bDBsSS96dUpyUU5ESmhJa1pHNGliWUtuYksrU1NCU1RTN2hTZVZHckdJTWQ0ZGlYL2dwVHZKb3R6ZFl5TFN1NkNEL05GdUVXTE9NeEZkOFJ4bDVtN3c0bUhmWWhMbGZob29kSXI3VzBLajhoQ0hZYXM1d1BEZkc2YkdYcVlkdUxmWVFpU2hvc3BBQjFJcTNxODdzUkZSeE4zUEZkYkJTRjFISFRhdDlZUVkrYmlwOHJOQmtQOG95NG1LSFNBekdYVFFDNUpkRWJiNHRSclB2SjRSVDZYSys3a1pJVmFMTFJDRENFTG1BM1FSSzkrMmtDL2N2cXdCamhXT3pZRlpWYjFsb1pVSnJWS3JNOHBYOVdvZU52VmRJUkxIZGJ1Mm54ZnpKSktSNkNZR21yN1kwdmsrTDFZNk5oT2daemV5RlY4c2EzMkdGZ1F1dGtRZXF1ZGdtOWF1bytEbXJXTGhkRWdWbmN5Tk1QK0VkOVdZWkR2aDdKWUQ4ZEREaWNseXJVaUdqeW93S2pYYnF4MVdJMS8yN0tDcVhJLzhEcXV6OFlPaEhxTWxucUdLNGozVGtnQ0JoUlQrdlVaM2RWdENYbDF1ZGtIaEZMRXBJZTB6cDUvQXJwN2N6WCt1Q2FER0FhL0lCV3ZLUER5bldDYUxNVzc2NkkxcThhcUlJUlM2K0cwYVBFQmtQN0YrQkV5eEdUNnVsV0JOQ25tMm0wVHE4eVdHazY2dUJobkVtOWFsa3JIUno4eGZQbEFlUC9XRVQ2WWNrbUFkSitJUmx1TnNvY3hOei9aaTZlS2ZlQnM3Qy9wODgzU2Z1Uk5BeDdvMW4zRjcySmoyMWJSOFp1anFoVmlJNGdKemdkRUhUTUFSMXQxancrZVhsM0Y0RXFNa1MvNlBtNzk0ZWIxaWt4M1YyZXBTOGlkalR1QXRSNU8xbmg2Q0tOV1ZrZVBIY0xjaVFtd1NpZ3BBbEFEZnc2RFNPbFR4MWt3RXJiOHJNd3VYU0ZPbmRwaUtuc3R5T0Nudk1ZckRYZ1d2d2N3anVUR3k5bFZlMjUwODYyZFFsb3Ywem1EZ0xoRzFDTStVa0kvTTc4bVFUQS9kQmY5S1pQY1hOS0JNUUtuYVphczZTa25yRUJYanIvZTVuTUdnZGtOM2JFb3BRZVVqQ0ltL3VoMk9HQ2h6QTQ3dkprQkFVY1FvY0c4MGxVMlpkZWZOcTlNZUNIMkhMSytYdlZNV2JZbmltUUlRbVI4a1ZOek4rQkZxNVdFdTZRdktFcjZuMUhBY3A3YnRoKzJ1KzBZOHVxbG5WT1hHMDhZWkhPb0hTNXM0UlJ1ejZiQzJvalI2Y3dGMG53VmFxWUFHcWo0T3h6K0RpdDBoZmMxbUp5VStJWWVabWFEK3Vjd09MWktnc1o1eXBTcUpqM09tVTBRZ1BTNWZ5TmlkR1dQTEJUSWRnS3pwN0lDdkt1UnZ6cXhCbVROVTZnMDNLc0RBNlNPUHlFeXhLaWpaTmUzS0owT2lENmZkQy9INUQxY0JzWisyQWk5eEN3VTVSNzVIZDhjQThDc0N2dEZaSEQyeC9pQ2pPY1ZvTWhvbWpXZzcrek1vbzNiMjBJM2tDcHRzM2dqL3I0Q25NVnM1V2JCcXNpWlZsR04xQXkwamFFSHJVZ0E9 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * f6KGOQVD9m6eArtp6UNZaW1lnym
URLs

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Searches\t0nyiwa_readme_.txt

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .BEcEdDBDBb You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- NTc2LXZ3N2hqN2ZHaWVlZ0JQM1pXeERlNC9xODNWKzlXNmROcEhhZ0k0dEZseTAwaThTb2h6QkZHcGxidUlrc2pQQkxRQ05Gd2tBZHRETTZ3SmZOaWFnamJoTGxaMElsb1pQNzFzN2gzUy9zNE5MV1FodUtMYmFjaFdIbGR4T1I5bTY3WGVEUllwNWNic0hSL0o2TXpOQ1VnRlM0SGVMMlpHWkpwdENVWjRLN0tITm4vQzdJek5BdWRVNk5saFJ6ODFBa1RGTS9iYzZhbFVQM0psb1h4Wks5WVd5U05LVGdZbzhqUG4zUVpBTHhob1RyMyt1Nkx4UW92QVZmS2psaTlFZGtnaEtWbmVyNENaMEdyZG84WTN3TFFTTzBOZjZhUENVdm9XdjYxL1VNUzdvMzJReU8xSVdEN3RHRTdCcTd2b3lxTFlZRkdMNGRPNHl0dzIrWGJ3bDBsSS96dUpyUU5ESmhJa1pHNGliWUtuYksrU1NCU1RTN2hTZVZHckdJTWQ0ZGlYL2dwVHZKb3R6ZFl5TFN1NkNEL05GdUVXTE9NeEZkOFJ4bDVtN3c0bUhmWWhMbGZob29kSXI3VzBLajhoQ0hZYXM1d1BEZkc2YkdYcVlkdUxmWVFpU2hvc3BBQjFJcTNxODdzUkZSeE4zUEZkYkJTRjFISFRhdDlZUVkrYmlwOHJOQmtQOG95NG1LSFNBekdYVFFDNUpkRWJiNHRSclB2SjRSVDZYSys3a1pJVmFMTFJDRENFTG1BM1FSSzkrMmtDL2N2cXdCamhXT3pZRlpWYjFsb1pVSnJWS3JNOHBYOVdvZU52VmRJUkxIZGJ1Mm54ZnpKSktSNkNZR21yN1kwdmsrTDFZNk5oT2daemV5RlY4c2EzMkdGZ1F1dGtRZXF1ZGdtOWF1bytEbXJXTGhkRWdWbmN5Tk1QK0VkOVdZWkR2aDdKWUQ4ZEREaWNseXJVaUdqeW93S2pYYnF4MVdJMS8yN0tDcVhJLzhEcXV6OFlPaEhxTWxucUdLNGozVGtnQ0JoUlQrdlVaM2RWdENYbDF1ZGtIaEZMRXBJZTB6cDUvQXJwN2N6WCt1Q2FER0FhL0lCV3ZLUER5bldDYUxNVzc2NkkxcThhcUlJUlM2K0cwYVBFQmtQN0YrQkV5eEdUNnVsV0JOQ25tMm0wVHE4eVdHazY2dUJobkVtOWFsa3JIUno4eGZQbEFlUC9XRVQ2WWNrbUFkSitJUmx1TnNvY3hOei9aaTZlS2ZlQnM3Qy9wODgzU2Z1Uk5BeDdvMW4zRjcySmoyMWJSOFp1anFoVmlJNGdKemdkRUhUTUFSMXQxancrZVhsM0Y0RXFNa1MvNlBtNzk0ZWIxaWt4M1YyZXBTOGlkalR1QXRSNU8xbmg2Q0tOV1ZrZVBIY0xjaVFtd1NpZ3BBbEFEZnc2RFNPbFR4MWt3RXJiOHJNd3VYU0ZPbmRwaUtuc3R5T0Nudk1ZckRYZ1d2d2N3anVUR3k5bFZlMjUwODYyZFFsb3Ywem1EZ0xoRzFDTStVa0kvTTc4bVFUQS9kQmY5S1pQY1hOS0JNUUtuYVphczZTa25yRUJYanIvZTVuTUdnZGtOM2JFb3BRZVVqQ0ltL3VoMk9HQ2h6QTQ3dkprQkFVY1FvY0c4MGxVMlpkZWZOcTlNZUNIMkhMSytYdlZNV2JZbmltUUlRbVI4a1ZOek4rQkZxNVdFdTZRdktFcjZuMUhBY3A3YnRoKzJ1KzBZOHVxbG5WT1hHMDhZWkhPb0hTNXM0UlJ1ejZiQzJvalI2Y3dGMG53VmFxWUFHcWo0T3h6K0RpdDBoZmMxbUp5VStJWWVabWFEK3Vjd09MWktnc1o1eXBTcUpqM09tVTBRZ1BTNWZ5TmlkR1dQTEJUSWRnS3pwN0lDdkt1UnZ6cXhCbVROVTZnMDNLc0RBNlNPUHlFeXhLaWpaTmUzS0owT2lENmZkQy9INUQxY0JzWisyQWk5eEN3VTVSNzVIZDhjQThDc0N2dEZaSEQyeC9pQ2pPY1ZvTWhvbWpXZzcrek1vbzNiMjBJM2tDcHRzM2dqL3I0Q25NVnM1V2JCcXNpWlZsR04xQXkwamFFSHJVZ0E9 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * 2FR7icI0zPoDWo1Nl1HglAAmA9Wb2Jh
URLs

http://avaddonbotrxmuyl.onion

Targets

    • Target

      db9f5ce9c4bc12ba9769c3f53c5c4c8168faba4cbd5d0119ea99e2db07c1d9bb

    • Size

      719KB

    • MD5

      456e570841e33662dc1e07fa3cc9f1fe

    • SHA1

      271c0abc2698b7bd197dd9a0c9630299849de767

    • SHA256

      db9f5ce9c4bc12ba9769c3f53c5c4c8168faba4cbd5d0119ea99e2db07c1d9bb

    • SHA512

      4dc75f7f892ce7512df44aa35b45b17a79685b36e8ccfc84ae10fe456cafcfd69b64443765a635174a71c8ef162b6b6dca419a7b85d2c20482e2493e48ca91e9

    • UAC bypass

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Checks whether UAC is enabled

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v6

Tasks