General

  • Target

    zip2.exe

  • Size

    92KB

  • Sample

    210725-jmxte8j7jx

  • MD5

    0f2c4685932a74e8a7bd4733ceea0fcc

  • SHA1

    51201bbf3d9b532d8882a4cda4fa40f35d093179

  • SHA256

    b0817a23a0189f43f8ceeb9899ade839f07da58dcf5a522d563c15382fba305a

  • SHA512

    c397d75914c49eba7725f886845aa8a6b02cfbbaef59f858507b0ebce836aafb9743bafd2f409097ec45eb68e0c333cfda0fc0607b37ddbbaca6c23e2f73d461

Malware Config

Extracted

Path

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note
YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: email itteam122@aol.com YOUR ID If you have not been answered via the link within 12 hours, write to us by e-mail: itteam122@techmail.info Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails

itteam122@aol.com

itteam122@techmail.info

Targets

    • Target

      zip2.exe

    • Size

      92KB

    • MD5

      0f2c4685932a74e8a7bd4733ceea0fcc

    • SHA1

      51201bbf3d9b532d8882a4cda4fa40f35d093179

    • SHA256

      b0817a23a0189f43f8ceeb9899ade839f07da58dcf5a522d563c15382fba305a

    • SHA512

      c397d75914c49eba7725f886845aa8a6b02cfbbaef59f858507b0ebce836aafb9743bafd2f409097ec45eb68e0c333cfda0fc0607b37ddbbaca6c23e2f73d461

    • Dharma

      Dharma is a ransomware that uses security software installation to hide malicious activities.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

File Deletion

2
T1107

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

2
T1490

Tasks