General

  • Target

    sqlservr.exe

  • Size

    1.8MB

  • Sample

    210920-dkqa2acga3

  • MD5

    e1338c42da2d2363afbbd0eeabad1ca9

  • SHA1

    fe5d669b732c9227bb25787083906f49b732c335

  • SHA256

    61c47effdf6b6eafd20e74a8a6b52da09e082fefef31c6ae4a2046b6a756050e

  • SHA512

    bcc887777c3bcb778000893c15357abcc9a78009a1cd8ae325de787a918d98ded1100fe9b21b79b16fe1d44d5d9fe0147292164ff36cf12a13e9e31b02ed372a

Malware Config

Extracted

Path

C:\Read Me.TXT

Ransom Note
8888888b. 888 888 Y88b 888 888 888 888 888 d88P .d88b. .d88888 .d88b. .d88b. 88888b.d88b. .d88b. 888d888 8888888P" d8P Y8b d88" 888 d8P Y8b d8P Y8b 888 "888 "88b d8P Y8b 888P" 888 T88b 88888888 888 888 88888888 88888888 888 888 888 88888888 888 888 T88b Y8b. Y88b 888 Y8b. Y8b. 888 888 888 Y8b. 888 888 T88b "Y8888 "Y88888 "Y8888 "Y8888 888 888 888 "Y8888 888 Made by Cerebrate - Dread Forums TOR [http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/] [Q1] What happened, I cannot open my files and they have an odd extension? [A1] Your files have been encrypted by Redeemer, a new ransomware operation. [Q2] Is there any way to recover my files? [A2] Yes, you can recover your files. This will however cost you money in XMR (Monero). [Q3] Is there any any way to recover my files without paying? [A3] Without paying it is impossible your files. Redeemer uses most secure algorithms and a sophisticated encryption scheme which guarantees security. Without a proper key, you will never regain access to your files. [Q4] What is XMR (Monero)? [A4] It is a privacy oriented cryptocurrency. You can learn more about Monero on getmonero.org. You can view ways to purchase it on www.monero.how/how-to-buy-monero. [Q5] How will I decrypt my files? [A5] Follow the general instructions: -1. Buy 02 XMR. -2. Contact helpdecryptmyfiles@yandex.com and send the following key: -----BEGIN REDEEMER PUBLIC KEY----- NDEhcAxlxZFcOah1x6Msz8aSJQCvSERJpvULl3I0gvggk5fyVG m2P5EvQCNsZOpDHGek5no49ldzt5nAV4yCMvLUKX69mLJ+oh+p D4cS3yqGJxvvv/nxFt1YtU1Yw9foQXjNNeOnMgTwn6gmSKoqHw 0DHmDOSWZeNq/sgcieAV9vsHNXF4TnCfEnICB3fi4piw11pf+T Yr91IQ54rnYG7BoPLgrTxRfWRogrxn3Fr9MzXpLkJ0YtIoNn3R A/x8dmAUm2Pwh+fpKBz/FUx3TtLvnHm8c3je2UHc12BEnw2Oly 6/cSmt/nDZ/rLgqhr+CrKcYK+j8MHM0vNVfXC9vTgbFS7W0/7G 6dfVXRm1fm90idVUznYsaNV0FUxJquKb4rmepYscl70Buh4RY0 U7ZZ6CWAZ2xd1fkpvz1Xr9IIWp+LQBeBaZPvsJqcZftVoWjyE9 YLwcwQfBhFneCtyhQf0dYOZ0uaPyq00R40DtNfqzL6LiwCFcWL ToC08EOxxGkDTBJ7N3XCHTX8hysU+d9gfoU98TjH3uDWZKJ5Gg uEy5XO34QsptBnk8mWDAMpozKlOdI0uPZn7zR7AU8lcwfYvtcr CJJrNKak+MiDpxKAo59w61FWJ1ZNasySth7OErawloU8tcen84 GhthukTZ/FQrEK+a6NSe8uPLBaG6b4mjTblA== -----END REDEEMER PUBLIC KEY----- -3. You will receive an XMR address where you will need to pay the requested amount of Monero. -4. After you pay and the payment is verified, you will receive a decryption tool and a key which will restore all your files and your computer back to normal.
Emails

helpdecryptmyfiles@yandex.com

Extracted

Path

C:\Read Me.TXT

Ransom Note
8888888b. 888 888 Y88b 888 888 888 888 888 d88P .d88b. .d88888 .d88b. .d88b. 88888b.d88b. .d88b. 888d888 8888888P" d8P Y8b d88" 888 d8P Y8b d8P Y8b 888 "888 "88b d8P Y8b 888P" 888 T88b 88888888 888 888 88888888 88888888 888 888 888 88888888 888 888 T88b Y8b. Y88b 888 Y8b. Y8b. 888 888 888 Y8b. 888 888 T88b "Y8888 "Y88888 "Y8888 "Y8888 888 888 888 "Y8888 888 Made by Cerebrate - Dread Forums TOR [http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/] [Q1] What happened, I cannot open my files and they have an odd extension? [A1] Your files have been encrypted by Redeemer, a new ransomware operation. [Q2] Is there any way to recover my files? [A2] Yes, you can recover your files. This will however cost you money in XMR (Monero). [Q3] Is there any any way to recover my files without paying? [A3] Without paying it is impossible your files. Redeemer uses most secure algorithms and a sophisticated encryption scheme which guarantees security. Without a proper key, you will never regain access to your files. [Q4] What is XMR (Monero)? [A4] It is a privacy oriented cryptocurrency. You can learn more about Monero on getmonero.org. You can view ways to purchase it on www.monero.how/how-to-buy-monero. [Q5] How will I decrypt my files? [A5] Follow the general instructions: -1. Buy 02 XMR. -2. Contact helpdecryptmyfiles@yandex.com and send the following key: -----BEGIN REDEEMER PUBLIC KEY----- MTAK4k1pfaewqYz8kbtiZBAJ2bLqybEnTQUjkVbRp0QudQEkTo 2bnZAYmruQNo390d3jhST98DGo+eH6f3eMZ+3eVq6PbOLOYBwY WHHPIOV02IWPGO4917ixFp0LD6ceyEVfSWjoBjDLlBPXqJMJ89 x28YDv21MV0Jy9o4GMDVuLjfKiroFJT2sCFn+foWf4UM24SiYg jeQRvHA5i8enWNh+Jljb9zFE7h/vBKYSwbJrUoPloyWkrFq6w6 oTzs0bmP+2pCjZEVSB7CSmxpJnvJyur6jO932S/HQmwz+8B5s8 8+kfm4CPvejmkHsLZQhgsGVd5cCRoWFGCxUW/8B7jGE+LcrETn WIivmN4h2yuiTpaotewcmnOlaF+Mg36AWmyk9BjAy7KpE26yAx kYXfNPBFEQ4Xk3oIPlvtqYkDZ7LuNSZrbkrFqzBSkStOGfxElV F12dAstpole9XGWmaKAyDsOYTJBon3USW9xGzTrAe4CtqRQHOw ShY/OSFeHX8i74V1REVCWkSOPSFYPC49PSByio1tZ54rcMknBe xCqIDpLrqxTanfrRTJLqwXD4X6Mg+PJZIvYAgzVGeVac3szUl9 iwCRsSK1CB4in+mbvVvEmQ9PQgEagMW+HbhNk01KhAKpwQmZdX NLx+4cbVO4J9fURsgaRc/I/jNv2ifelKMJWQ== -----END REDEEMER PUBLIC KEY----- -3. You will receive an XMR address where you will need to pay the requested amount of Monero. -4. After you pay and the payment is verified, you will receive a decryption tool and a key which will restore all your files and your computer back to normal.
Emails

helpdecryptmyfiles@yandex.com

Targets

    • Target

      sqlservr.exe

    • Size

      1.8MB

    • MD5

      e1338c42da2d2363afbbd0eeabad1ca9

    • SHA1

      fe5d669b732c9227bb25787083906f49b732c335

    • SHA256

      61c47effdf6b6eafd20e74a8a6b52da09e082fefef31c6ae4a2046b6a756050e

    • SHA512

      bcc887777c3bcb778000893c15357abcc9a78009a1cd8ae325de787a918d98ded1100fe9b21b79b16fe1d44d5d9fe0147292164ff36cf12a13e9e31b02ed372a

    • Clears Windows event logs

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Modifies WinLogon

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Winlogon Helper DLL

1
T1004

Defense Evasion

Indicator Removal on Host

1
T1070

File Deletion

2
T1107

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

2
T1490

Tasks