Resubmissions

28-02-2024 18:31

240228-w6jpgsah67 10

28-02-2024 18:30

240228-w5h2kaag7s 10

11-01-2024 08:38

240111-kj2e8sddf8 10

11-01-2024 08:35

240111-kg362sddb7 10

26-07-2021 12:39

210726-18w9pcbxzs 10

General

  • Target

    10bce0ff6597f347c3cca8363b7c81a8bff52d2ff81245cd1e66a6e11aeb25da.sample

  • Size

    1.3MB

  • Sample

    210726-18w9pcbxzs

  • MD5

    9f05994819a3d8c1a3769352c7c39d1d

  • SHA1

    eb2457196e04dfdd54f70bd32ed02ae854d45bc0

  • SHA256

    10bce0ff6597f347c3cca8363b7c81a8bff52d2ff81245cd1e66a6e11aeb25da

  • SHA512

    32cac848f47a0096773435c6365fcbd6bdb02115aae2677aec5a86031b6def938033210fdcf0e12f735aa5ceb8cd4be5f7edb5cdc437bbca61f0d79196ec9be8

Malware Config

Extracted

Path

C:\PROGRAM FILES\WINDOWS SIDEBAR\GADGETS\SLIDESHOW.GADGET\IMAGES\ON_DESKTOP\readme.txt

Family

dearcry

Ransom Note
Your file has been encrypted! If you want to decrypt, please contact us. [email protected] or [email protected] And please send me the following hash! 2133c369fb115ea61eebd7b62768decf

Targets

    • Target

      10bce0ff6597f347c3cca8363b7c81a8bff52d2ff81245cd1e66a6e11aeb25da.sample

    • Size

      1.3MB

    • MD5

      9f05994819a3d8c1a3769352c7c39d1d

    • SHA1

      eb2457196e04dfdd54f70bd32ed02ae854d45bc0

    • SHA256

      10bce0ff6597f347c3cca8363b7c81a8bff52d2ff81245cd1e66a6e11aeb25da

    • SHA512

      32cac848f47a0096773435c6365fcbd6bdb02115aae2677aec5a86031b6def938033210fdcf0e12f735aa5ceb8cd4be5f7edb5cdc437bbca61f0d79196ec9be8

    • DearCry

      DearCry is a ransomware first seen after the 2021 Microsoft Exchange hacks.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v6

Tasks