General

  • Target

    8184432307b0f546d168e3e386a20999f5b0de0bd4085753bb2b09cfc7fec071.sample

  • Size

    276KB

  • Sample

    210726-nq4jm6wjvx

  • MD5

    6bfa1c01c3af6206a189b975178965fe

  • SHA1

    260dd322089862a5400a00dbcb35774b66ce2d47

  • SHA256

    8184432307b0f546d168e3e386a20999f5b0de0bd4085753bb2b09cfc7fec071

  • SHA512

    f518f82554b7a4d6c14655cd980ab710e08c20b3efb2979e39429c44cdf85f66f6db2021bd4758ec6cdcfa4c89fe3224628198094888adc4af243d17c730ddf8

Malware Config

Extracted

Path

C:\Documents and Settings\-!RecOveR!-ibefa++.Txt

Ransom Note
+639/8;4,&&2;9!/) 0?< 5'"3*;%8* ------- +639/8;4,&&2;9!/) 0?< 5'"3*;%8* NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA-4096. Use the link down below to find additional information on the encryption keys using RSA-4096 https://en.wikipedia.org/wiki/RSA_(cryptosystem) +639/8;4,&&2;9!/) 0?< 5'"3*;%8* ------- +639/8;4,&&2;9!/) 0?< 5'"3*;%8* What exactly that means? It means that on a structural level your files have been transformed . You won't be able to use , read , see or work with them anymore . In other words they are useless , however , there is a possibility to restore them with our help . What exactly happened to your files ??? !!! Two personal RSA-4096 keys were generated for your PC/Laptop; one key is public, another key is private. !!! All your data and files were encrypted by the means of the public key , which you received over the web . !!! In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. +639/8;4,&&2;9!/) 0?< 5'"3*;%8* ----- +639/8;4,&&2;9!/) 0?< 5'"3*;%8* !!! What should you do next ??? In case you have valuable files , we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions , please access your personal homepage by choosing one of the few addresses down below : http://74bfc.flubspiel.com/52C28F7421287E23 http://ibf4d.ukegaub.at/52C28F7421287E23 http://k3cxd.pileanoted.com/52C28F7421287E23 If you can't access your personal homepage or the addresses are not working, complete the following steps: *** Download and Install TOR Browser - http://www.torproject.org/projects/torbrowser.html.en *** Run TOR Browser Insert link in the address bar: xzjvzkgjxebzreap.onion/52C28F7421287E23 +639/8;4,&&2;9!/) 0?< 5'"3*;%8*----IMPORTANT*****************INFORMATION---------+639/8;4,&&2;9!/) 0?< 5'"3*;%8* Your personal homepages http://74bfc.flubspiel.com/52C28F7421287E23 http://ibf4d.ukegaub.at/52C28F7421287E23 http://k3cxd.pileanoted.com/52C28F7421287E23 Your personal homepage Tor-Browser xzjvzkgjxebzreap.onion/52C28F7421287E23 Your personal ID 52C28F7421287E23 +639/8;4,&&2;9!/) 0?< 5'"3*;%8* +639/8;4,&&2;9!/) 0?< 5'"3*;%8* +639/8;4,&&2;9!/) 0?< 5'"3*;%8*
URLs

http://74bfc.flubspiel.com/52C28F7421287E23

http://ibf4d.ukegaub.at/52C28F7421287E23

http://k3cxd.pileanoted.com/52C28F7421287E23

http://xzjvzkgjxebzreap.onion/52C28F7421287E23

Extracted

Path

C:\Boot\bg-BG\-!RecOveR!-ftunh++.Txt

Ransom Note
(:6*5724(.53/5&>?0%2&2#0*=1+1<0 ------- (:6*5724(.53/5&>?0%2&2#0*=1+1<0 NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA-4096. Use the link down below to find additional information on the encryption keys using RSA-4096 https://en.wikipedia.org/wiki/RSA_(cryptosystem) (:6*5724(.53/5&>?0%2&2#0*=1+1<0 ------- (:6*5724(.53/5&>?0%2&2#0*=1+1<0 What exactly that means? It means that on a structural level your files have been transformed . You won't be able to use , read , see or work with them anymore . In other words they are useless , however , there is a possibility to restore them with our help . What exactly happened to your files ??? !!! Two personal RSA-4096 keys were generated for your PC/Laptop; one key is public, another key is private. !!! All your data and files were encrypted by the means of the public key , which you received over the web . !!! In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. (:6*5724(.53/5&>?0%2&2#0*=1+1<0 ----- (:6*5724(.53/5&>?0%2&2#0*=1+1<0 !!! What should you do next ??? In case you have valuable files , we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions , please access your personal homepage by choosing one of the few addresses down below : http://74bfc.flubspiel.com/D87F7A5EA1CD454A http://ibf4d.ukegaub.at/D87F7A5EA1CD454A http://k3cxd.pileanoted.com/D87F7A5EA1CD454A If you can't access your personal homepage or the addresses are not working, complete the following steps: *** Download and Install TOR Browser - http://www.torproject.org/projects/torbrowser.html.en *** Run TOR Browser Insert link in the address bar: xzjvzkgjxebzreap.onion/D87F7A5EA1CD454A (:6*5724(.53/5&>?0%2&2#0*=1+1<0----IMPORTANT*****************INFORMATION---------(:6*5724(.53/5&>?0%2&2#0*=1+1<0 Your personal homepages http://74bfc.flubspiel.com/D87F7A5EA1CD454A http://ibf4d.ukegaub.at/D87F7A5EA1CD454A http://k3cxd.pileanoted.com/D87F7A5EA1CD454A Your personal homepage Tor-Browser xzjvzkgjxebzreap.onion/D87F7A5EA1CD454A Your personal ID D87F7A5EA1CD454A (:6*5724(.53/5&>?0%2&2#0*=1+1<0 (:6*5724(.53/5&>?0%2&2#0*=1+1<0 (:6*5724(.53/5&>?0%2&2#0*=1+1<0
URLs

http://74bfc.flubspiel.com/D87F7A5EA1CD454A

http://ibf4d.ukegaub.at/D87F7A5EA1CD454A

http://k3cxd.pileanoted.com/D87F7A5EA1CD454A

http://xzjvzkgjxebzreap.onion/D87F7A5EA1CD454A

Targets

    • Target

      8184432307b0f546d168e3e386a20999f5b0de0bd4085753bb2b09cfc7fec071.sample

    • Size

      276KB

    • MD5

      6bfa1c01c3af6206a189b975178965fe

    • SHA1

      260dd322089862a5400a00dbcb35774b66ce2d47

    • SHA256

      8184432307b0f546d168e3e386a20999f5b0de0bd4085753bb2b09cfc7fec071

    • SHA512

      f518f82554b7a4d6c14655cd980ab710e08c20b3efb2979e39429c44cdf85f66f6db2021bd4758ec6cdcfa4c89fe3224628198094888adc4af243d17c730ddf8

    • suricata: ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Deletes itself

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks