General

  • Target

    730DBBFB.exe

  • Size

    169KB

  • Sample

    210727-ms39r28k9a

  • MD5

    65c3956288e16bdcc55e3c9c6b94ba5b

  • SHA1

    33aa83e00711a32e0960dcf670ae2fa891049170

  • SHA256

    e7fe3b83e1730593d372b5a848e84066c07d75ee4790395a258822cfb8502412

  • SHA512

    813db16eeacf96589468881872ec15e55760dacf27f90060298972036ab22243337abd5f9bce266063a89fccc45ded069cb4bb4172946acc4a54e5ac49853c76

Score
10/10

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\!!Read_Me.FC30D.html

Ransom Note
#ALL YOUR FILES ARE ENCRYPTED AND STOLEN BY RAGNAROK Dear Sir Your files are encrypted with RSA4096 and AES encryption algorithm. But don't worry, you can return all your files!! follow the instructions to recover your files Cooperate with us and get the decrypter program as soon as possible will be your best solution. Only our software can decrypt all your encrypted files. What guarantees you have? We take our reputation seriously. We reject any form of deceptionYou can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain any valuable information. When hiring third-party negotiators or recovery companies. listen to what they tell you. try to think. Are they really interested in solving your problems or are they just thinking about their profit and ambitions? By the way.We have stolen lots of your company and your private data which includes doc,xls,pdf,jpg,mdf,sql,pst... Here we upload sample files of your company and your private data on our blog : http://sushlnty2j7qdzy64qnvyb6ajkwg7resd3p6agc2widnawodtcedgjid.onion/ We promise that if you don't pay within a week, we will package and publish all of your company and your data on our website. We also promise we can decrypt all of your data and delete all your files on internet after your payment. Such leaks of information lead to losses for the company. fines and lawsuits. And don't forget that information can fall into the hands of competitors! For us this is just business and to prove to you our seriousness. Our e-mail: CHRISTIAN1986@TUTANOTA.COM Reserve e-mail: melling@confidential.tips Device ID: =AAAfBTMuAjLwEjLwEDLBh1UQZkQGdELEdzQCNTN3Y0N2EzQyUUN3EUQ0UTOyYjN2gDN4MzM0IUNxI0QDFEMCJjQ1UTO2EUMFREMGZEOGBTRyE0N5gDMDFENBRzN1MENwIERxEjQEBTQEdDRwQUR5ATQCZ0MBljRBdjN1IkMGBDOCRTNBVzMFNjR0MTM0UTNygzQEBzMEJTNFF0QGZjQEhTN1MkRxQTR5MUO2QDMEdTO1UkQFBjMEFEO4IERDJ0Q2YENFNENwgTOBlTR4IENERUM1YkMwU0QwUTM5UENGNzQzIjQzUzM1UjN0YTQ4UDOERER0kTRBhjRzMEM3IURFJDOxYDN3YzMDJzQDNkN2YUQGhjRFlzNDZTRDVUO4MzM1YURwATO4EDO0UkQzYTNwczQGZUN0QDREJzQDlTOEFUOEJEN2kTM5YDO2czN1UEO1U0QEBTRyIkN1EkRzMDNyEDOwgjNwYENBREO0YTMENURxQzMFVDN3ATQ4MjNFRTNGRDRCdjQCNEOwIkMFR0MwAjQENjNxQkRCVjMFFENCRjNzETQFZkN3UEMBljM0U0M2cDO0MUQ4ATRClTN2MjNChTRDFEN1kzQ2YkNEV0N1AzQDZDOBdjRBZDR4cTM2MjN4Q0NxgTM1QEM2MUMwQEODJDNxYTN5UEOxIEN4EURFNUN0YDO2QERzIkRzEjRBVzNCFUR4cTO1EDMFVDR2YzQyIkRGhTNFBDNxgjRFJTOzEkMzETOEREO1AjMxYUNGZkRENUQyEUQzEUMFRjM0YkQFFkMGNDM3MzMxEjQ0UzQGZEMGdTOxkjR5MjM3cTOwUUN0ADNycjNxMkMGZjR5QjQ0IDR1UDR0EjRCVjMDZkQDNzQ2YDOykDNwEDNzM0MENDN4YUQCFzM5Y0NwkzQ5UkMyEDOxczQDNkMzMEMDFDRDFDR5YTOwcTQxUTOzYDNwgTN3gTN0UzMzQUREZkQEhDMFVkM2MERBVkM5UERCdzQFhDOzYDRyADRwMUOFVDO4UTMCRkR0QDRGV0NyY0Q5cjR1kzN5AzNGdDN2ADM5cTNxIUN3UEMzU0QFFjM1czN5YUNCV0Q5MUNzgTMDFDRBZTM0YUNwcjQygDOEhzQ0QERwUjM0IjR3MUNBBTOwEENxITO5ADOwcTQCFTQCNTRGVDOyQTREdTOyIUQyMjRzEER0EUQ5AzQGVENFF0Q0ITMyMUMFZ0Q3MjN2AjQGRENGlTM4ATQyIDO2EUO4QjM2AzQEN0Q5AjNwYUN1EUO1IUNDljMCNzN3IzQyQEN2IjNyMDOzQUQ4ITM2IzN1YzNDRkQzEUR0kDRwYUR0kjNyAzN5gTNzIzN0ITQ2YkMGlTN3IkQBRUR2IUNBNjMDFjNyMDR4MUODRTQ2czN0wyMBBzMBREO3UERBNUMFNzNEFUM2QjQxIkQFhzNBFERCVURDRERCVUMxYTQ4AzNDdzN3IjRDVDNzEDRwQjRwkTO1YzM2UDNFNkM1MDM4kjRDdjQBVEOBNUMxADNBlTMxM0QzEjQ0YjM5M0M1MUR1IkQDVkMDFzMzIUREFER5gDNyYkQykDR0UENEFTQ3ATN5ETNDBzQ3EkM4YTMFBTQFFkRzUjRCVkRDZkNBZkRDZENCFDO4UjQFZEOEhzM1czMBJjNwUERxAzNDFzNFdjREJTOzIENDFUQGFzNCJ0NyADRDVUM2gTNzUEN3ADODFEN0E0QxYzNFVTNCNjM4EkMBFEM0Q0M0gjRxYDODFTREVUM3QERCVDNFFzMzgjMzUEN3IUOCdzQ5YEN1EUO1YER1ATQFlDRycTQzE0MFVkQFBzM0cjNDV0QFNzQ5EUO5UDO2YDRCljM4UUMEFkM0YTMxgjRDJTNEdDNFFkQDFDO5UjREdjNwQkNzkTQ2cTM3cjQDFUR2QjR2UUQ4EDMGlTNENUR0EkQER0QxQjRDRjREJ0QyYTQERUM5IkNGZjQChzNGhDMClDOGVDM2IUQ5QjNBdDODZERCF0Q3IUO5MkQyEEMxATRxgzN5cDRxYjNBJER1I0MwkjMBNzQ2UDN3QjR5IERGJER0YjRzIkRDJTMxYjMEVzQ1QTRyQUM0QUQxgDR4YENGdTQ5YkMDV0N3ADRBFUO0Q0MzQkNDZDM4UUR4EENEVjQDdjQwU0Q1kDOyYUQxADOwQTM2gTQxczMzQEMCVkN1gjMxQkNGdTN4QDR0Y0NBVUMCdTQwEkQCVTQDFURFlDRFF0QFNEO2MEM5EDO1cjM5UTQ3QUN1gTQFNjQ2QTOEFjQ0cjRCJkN2IDNyYzQzQTOFFjNDhzQBV0NCNTRBR0M5UkR5ADOyQDR4IUO3EEOwITQ0YjN1UUR1UDRwkTN1Y0MycTRBhjNFlTQxkDOxQkRBJTOwMEOzczN4AjM0EUQBV0QzMkN2EEMGZjRDZ0M0UUNEhjQCVzQGJDN3QEN5UkNDVEMClTR1IDMBVTN4YDMFRTQwczQyM0M0ATN0YTM4ADRzEEOxEDMBNTR0cTMGVTQ2kDM3YTOwIkNwYDNxYTM3QER5UDR2EjQGRER0YUR0gTQFNkQBlTQGhjMBdDNzgjRFZDRGVDMwETNEFzMxUTQDlTRDdTN2QzM1YTO4QkN5UEMxUkQ1YzM3YTNxETM4gDNxMzMzYDR0E0NwEUR0IDO2ATOwQERERUQwEkMwQ0MDFURClTQGNDR3UERyMkNykTQ4gzMFFUM5YUOwUDRxAjN3M0N2QkM5IjNGdTOyUTQxETO2cDRCJEN2YkQ5kDR3ETM
Emails

CHRISTIAN1986@TUTANOTA.COM

melling@confidential.tips

URLs

http://sushlnty2j7qdzy64qnvyb6ajkwg7resd3p6agc2widnawodtcedgjid.onion/

Targets

    • Target

      730DBBFB.exe

    • Size

      169KB

    • MD5

      65c3956288e16bdcc55e3c9c6b94ba5b

    • SHA1

      33aa83e00711a32e0960dcf670ae2fa891049170

    • SHA256

      e7fe3b83e1730593d372b5a848e84066c07d75ee4790395a258822cfb8502412

    • SHA512

      813db16eeacf96589468881872ec15e55760dacf27f90060298972036ab22243337abd5f9bce266063a89fccc45ded069cb4bb4172946acc4a54e5ac49853c76

    Score
    10/10
    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies boot configuration data using bcdedit

    • Modifies Windows Firewall

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Deletes itself

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Defense Evasion

File Deletion

2
T1107

Modify Registry

1
T1112

Discovery

Remote System Discovery

1
T1018

Impact

Inhibit System Recovery

3
T1490

Tasks