General

  • Target

    4fb7ed41b7b482bc52c5a2c113b86911d86ef3d1ba1a4651a189b4bbb1901fa6

  • Size

    11.7MB

  • Sample

    210728-yefbdwsjzs

  • MD5

    9034541bba99fa6733cac83be275c494

  • SHA1

    261aa48cd35e60d8d480c3c5a2afba72b713371a

  • SHA256

    4fb7ed41b7b482bc52c5a2c113b86911d86ef3d1ba1a4651a189b4bbb1901fa6

  • SHA512

    200680c158912aba421fc0d0ef6c1f71a210fc2e28b7a9c891cffb88669aface276aedb9e46cd55f43001a25d8cebb8dcf225c3bfb1aecfc3e419a6b0fb94170

Malware Config

Extracted

Path

C:\SORRY-FOR-FILES.txt

Ransom Note
#What happened to your files? All of your important files encrypted with AES-256 , is a powerful cryptography algorithm For more information you can use Wikipedia. Don't rename or edit encrypted files because it will be impossible to decrypt your files ***** How to recover files???? ***** Your main guarantee is the ability to decrypt test files. This means that we can decrypt all your files after paying the ransom. You can upload a sample encrypted file on our site. And your file will be decrypted. You can download it to test You can only decrypt the sample file once. This is to trust us that all your files will be decrypted Be careful not to change the name before uploading the encrypted file. *** You need ti install Tor Browser *** To access a . onion address, you'll need to access it through the Tor Browser. You can download tor browser from https://www.torproject.org/download Our site address: http://3udp4kspxiirvxop.onion/ *** send us a message in the Telegram messager *** After sending bitcoins to us. We will send you your private key decryption program For Trust You can Send us Test Files And We Decrypt That And Send To You. To install Telegram, you can search in Google. Download Telegram. Telegram website: https://telegram.org Telegram ID : https://t.me/venomous_support Your unique Id : 2FTPMXZPBOVD *** If telegram was not available for any reason *** You can email us your encrypted sample file for decryption Our email address: venomous.files@tutanota.com Your unique Id : 2FTPMXZPBOVD **** What is Bitcoin? *** Bitcoin is an innovative payment network and a new kind of money. You can create a Bitcoin account at https://blockchain.info/ and deposit some money into your account and then send to us *** How to buy Bitcoin? *** There are Many way to buy Bitcoin and deposit it into your account, You can buy it with WesternUnion, Bank Wire, International Bank transfer, Cash deposit and etc https://localbitcoins.com ---> Buy Bitcoin with WesternUnion or MoneyGram https://coincafe.com ---> Buy Bitcoin fast and Secure with WesternUnion and Cash deposit https://www.bitstamp.net ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment https://www.kraken.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment https://www.kraken.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment https://www.ccedk.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment https://bitcurex.com/ ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment If you want to pay with your Business bank account you should create a business account in exchangers they don't accept payment from third party
Emails

venomous.files@tutanota.com

URLs

http://3udp4kspxiirvxop.onion/

https://t.me/venomous_support

Targets

    • Target

      4fb7ed41b7b482bc52c5a2c113b86911d86ef3d1ba1a4651a189b4bbb1901fa6

    • Size

      11.7MB

    • MD5

      9034541bba99fa6733cac83be275c494

    • SHA1

      261aa48cd35e60d8d480c3c5a2afba72b713371a

    • SHA256

      4fb7ed41b7b482bc52c5a2c113b86911d86ef3d1ba1a4651a189b4bbb1901fa6

    • SHA512

      200680c158912aba421fc0d0ef6c1f71a210fc2e28b7a9c891cffb88669aface276aedb9e46cd55f43001a25d8cebb8dcf225c3bfb1aecfc3e419a6b0fb94170

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Tasks