General

  • Target

    6408692395966464.zip

  • Size

    11.9MB

  • Sample

    210618-wkcp54d48n

  • MD5

    d0c9e4a15e172272d05bcfec4bab7764

  • SHA1

    b02c9e876a0b84c17ca098c18e46b79962c8a73a

  • SHA256

    a1fae764f4d282fd761c88399668c2d89435b102a53559e5ef686cce82b11a9f

  • SHA512

    6c9b230b553012da684e594ebf461ca7c2729a222edaf4b9c9aca1b905f3bb9cbaead383b90bb56e89e969004c98edfe4b1463fc3c8e8bd40b8ffe514a174b89

Malware Config

Extracted

Path

C:\decrypt_file.TxT

Ransom Note
*************************** | We Are Back ? *************************** We hacked your (( Network )), and now all files, documents, images, databases and other important data are safely encrypted using the strongest algorithms ever. You cannot access any of your files or services . But do not worry. You can restore everthing and get back business very soon ( depends on your actions ) before I tell how you can restore your data, you have to know certain things : We have downloaded most of your data ( especially important data ) , and if you don't contact us within 2 days, your data will be released to the public. To see what happens to those who didn't contact us, just google : ( Blackkingdom Ransomware ) *************************** | What guarantees ? *************************** We understand your stress and anxiety. So you have a free opportunity to test our service by instantly decrypting one or two files for free just send the files you want to decrypt to (support_blackkingdom2@protonmail.com *************************************************** | How to contact us and recover all of your files ? *************************************************** The only way to recover your files and protect from data leaks, is to purchase a unique private key for you that we only posses . [ + ] Instructions: 1- Send the decrypt_file.txt file to the following email ===> support_blackkingdom2@protonmail.com 2- send the following amount of US dollars ( 10,000 ) worth of bitcoin to this address : [ 1Lf8ZzcEhhRiXpk6YNQFpCJcUisiXb34FT ] 3- confirm your payment by sending the transfer url to our email address 4- After you submit the payment, the data will be removed from our servers, and the decoder will be given to you, so that you can recover all your files. ## Note ## Dear system administrators, do not think you can handle it on your own. Notify your supervisors as soon as possible. By hiding the truth and not communicating with us, what happened will be published on social media and yet in news websites. Your ID ==> ibQH1raie5qqmK3BNdea
Emails

support_blackkingdom2@protonmail.com

Wallets

1Lf8ZzcEhhRiXpk6YNQFpCJcUisiXb34FT

Extracted

Path

C:\decrypt_file.TxT

Ransom Note
*************************** | We Are Back ? *************************** We hacked your (( Network )), and now all files, documents, images, databases and other important data are safely encrypted using the strongest algorithms ever. You cannot access any of your files or services . But do not worry. You can restore everthing and get back business very soon ( depends on your actions ) before I tell how you can restore your data, you have to know certain things : We have downloaded most of your data ( especially important data ) , and if you don't contact us within 2 days, your data will be released to the public. To see what happens to those who didn't contact us, just google : ( Blackkingdom Ransomware ) *************************** | What guarantees ? *************************** We understand your stress and anxiety. So you have a free opportunity to test our service by instantly decrypting one or two files for free just send the files you want to decrypt to (support_blackkingdom2@protonmail.com *************************************************** | How to contact us and recover all of your files ? *************************************************** The only way to recover your files and protect from data leaks, is to purchase a unique private key for you that we only posses . [ + ] Instructions: 1- Send the decrypt_file.txt file to the following email ===> support_blackkingdom2@protonmail.com 2- send the following amount of US dollars ( 10,000 ) worth of bitcoin to this address : [ 1Lf8ZzcEhhRiXpk6YNQFpCJcUisiXb34FT ] 3- confirm your payment by sending the transfer url to our email address 4- After you submit the payment, the data will be removed from our servers, and the decoder will be given to you, so that you can recover all your files. ## Note ## Dear system administrators, do not think you can handle it on your own. Notify your supervisors as soon as possible. By hiding the truth and not communicating with us, what happened will be published on social media and yet in news websites. Your ID ==> o0tD9AesWDCoVKnpcjXT
Emails

support_blackkingdom2@protonmail.com

Wallets

1Lf8ZzcEhhRiXpk6YNQFpCJcUisiXb34FT

Targets

    • Target

      b9dbdf11da3630f464b8daace88e11c374a642e5082850e9f10a1b09d69ff04f

    • Size

      12.2MB

    • MD5

      f8b604ca7aa304a479f2461d1b74e795

    • SHA1

      0539c6df68e9ef15cbfa1f07daca8fd759fef874

    • SHA256

      b9dbdf11da3630f464b8daace88e11c374a642e5082850e9f10a1b09d69ff04f

    • SHA512

      45584e50e87cacc8b3853402a77b8e882a2de3d9d1a2de6d1a23684a95a656e5bd32055ead030ae157d116b48aad5dc75e24a1cfddfaf08b3913435954c83e68

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Tasks