General
- Target sqlservr.exe
- Size 1.8MB
- Sample210920-dkqa2acga3
- SHA256 61c47effdf6b6eafd20e74a8a6b52da09e082fefef31c6ae4a2046b6a756050e
Score
10/10
Malware Config
Extracted
Path
-
C:\Read Me.TXT
Ransom Note
- 8888888b. 888 888 Y88b 888 888 888 888 888 d88P .d88b. .d88888 .d88b. .d88b. 88888b.d88b. .d88b. 888d888 8888888P" d8P Y8b d88" 888 d8P Y8b d8P Y8b 888 "888 "88b d8P Y8b 888P" 888 T88b 88888888 888 888 88888888 88888888 888 888 888 88888888 888 888 T88b Y8b. Y88b 888 Y8b. Y8b. 888 888 888 Y8b. 888 888 T88b "Y8888 "Y88888 "Y8888 "Y8888 888 888 888 "Y8888 888 Made by Cerebrate - Dread Forums TOR [http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/] [Q1] What happened, I cannot open my files and they have an odd extension? [A1] Your files have been encrypted by Redeemer, a new ransomware operation. [Q2] Is there any way to recover my files? [A2] Yes, you can recover your files. This will however cost you money in XMR (Monero). [Q3] Is there any any way to recover my files without paying? [A3] Without paying it is impossible your files. Redeemer uses most secure algorithms and a sophisticated encryption scheme which guarantees security. Without a proper key, you will never regain access to your files. [Q4] What is XMR (Monero)? [A4] It is a privacy oriented cryptocurrency. You can learn more about Monero on getmonero.org. You can view ways to purchase it on www.monero.how/how-to-buy-monero. [Q5] How will I decrypt my files? [A5] Follow the general instructions: -1. Buy 02 XMR. -2. Contact [email protected] and send the following key: -----BEGIN REDEEMER PUBLIC KEY----- NDEhcAxlxZFcOah1x6Msz8aSJQCvSERJpvULl3I0gvggk5fyVG m2P5EvQCNsZOpDHGek5no49ldzt5nAV4yCMvLUKX69mLJ+oh+p D4cS3yqGJxvvv/nxFt1YtU1Yw9foQXjNNeOnMgTwn6gmSKoqHw 0DHmDOSWZeNq/sgcieAV9vsHNXF4TnCfEnICB3fi4piw11pf+T Yr91IQ54rnYG7BoPLgrTxRfWRogrxn3Fr9MzXpLkJ0YtIoNn3R A/x8dmAUm2Pwh+fpKBz/FUx3TtLvnHm8c3je2UHc12BEnw2Oly 6/cSmt/nDZ/rLgqhr+CrKcYK+j8MHM0vNVfXC9vTgbFS7W0/7G 6dfVXRm1fm90idVUznYsaNV0FUxJquKb4rmepYscl70Buh4RY0 U7ZZ6CWAZ2xd1fkpvz1Xr9IIWp+LQBeBaZPvsJqcZftVoWjyE9 YLwcwQfBhFneCtyhQf0dYOZ0uaPyq00R40DtNfqzL6LiwCFcWL ToC08EOxxGkDTBJ7N3XCHTX8hysU+d9gfoU98TjH3uDWZKJ5Gg uEy5XO34QsptBnk8mWDAMpozKlOdI0uPZn7zR7AU8lcwfYvtcr CJJrNKak+MiDpxKAo59w61FWJ1ZNasySth7OErawloU8tcen84 GhthukTZ/FQrEK+a6NSe8uPLBaG6b4mjTblA== -----END REDEEMER PUBLIC KEY----- -3. You will receive an XMR address where you will need to pay the requested amount of Monero. -4. After you pay and the payment is verified, you will receive a decryption tool and a key which will restore all your files and your computer back to normal.
Emails
Extracted
Path
-
C:\Read Me.TXT
Ransom Note
- 8888888b. 888 888 Y88b 888 888 888 888 888 d88P .d88b. .d88888 .d88b. .d88b. 88888b.d88b. .d88b. 888d888 8888888P" d8P Y8b d88" 888 d8P Y8b d8P Y8b 888 "888 "88b d8P Y8b 888P" 888 T88b 88888888 888 888 88888888 88888888 888 888 888 88888888 888 888 T88b Y8b. Y88b 888 Y8b. Y8b. 888 888 888 Y8b. 888 888 T88b "Y8888 "Y88888 "Y8888 "Y8888 888 888 888 "Y8888 888 Made by Cerebrate - Dread Forums TOR [http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/] [Q1] What happened, I cannot open my files and they have an odd extension? [A1] Your files have been encrypted by Redeemer, a new ransomware operation. [Q2] Is there any way to recover my files? [A2] Yes, you can recover your files. This will however cost you money in XMR (Monero). [Q3] Is there any any way to recover my files without paying? [A3] Without paying it is impossible your files. Redeemer uses most secure algorithms and a sophisticated encryption scheme which guarantees security. Without a proper key, you will never regain access to your files. [Q4] What is XMR (Monero)? [A4] It is a privacy oriented cryptocurrency. You can learn more about Monero on getmonero.org. You can view ways to purchase it on www.monero.how/how-to-buy-monero. [Q5] How will I decrypt my files? [A5] Follow the general instructions: -1. Buy 02 XMR. -2. Contact [email protected] and send the following key: -----BEGIN REDEEMER PUBLIC KEY----- MTAK4k1pfaewqYz8kbtiZBAJ2bLqybEnTQUjkVbRp0QudQEkTo 2bnZAYmruQNo390d3jhST98DGo+eH6f3eMZ+3eVq6PbOLOYBwY WHHPIOV02IWPGO4917ixFp0LD6ceyEVfSWjoBjDLlBPXqJMJ89 x28YDv21MV0Jy9o4GMDVuLjfKiroFJT2sCFn+foWf4UM24SiYg jeQRvHA5i8enWNh+Jljb9zFE7h/vBKYSwbJrUoPloyWkrFq6w6 oTzs0bmP+2pCjZEVSB7CSmxpJnvJyur6jO932S/HQmwz+8B5s8 8+kfm4CPvejmkHsLZQhgsGVd5cCRoWFGCxUW/8B7jGE+LcrETn WIivmN4h2yuiTpaotewcmnOlaF+Mg36AWmyk9BjAy7KpE26yAx kYXfNPBFEQ4Xk3oIPlvtqYkDZ7LuNSZrbkrFqzBSkStOGfxElV F12dAstpole9XGWmaKAyDsOYTJBon3USW9xGzTrAe4CtqRQHOw ShY/OSFeHX8i74V1REVCWkSOPSFYPC49PSByio1tZ54rcMknBe xCqIDpLrqxTanfrRTJLqwXD4X6Mg+PJZIvYAgzVGeVac3szUl9 iwCRsSK1CB4in+mbvVvEmQ9PQgEagMW+HbhNk01KhAKpwQmZdX NLx+4cbVO4J9fURsgaRc/I/jNv2ifelKMJWQ== -----END REDEEMER PUBLIC KEY----- -3. You will receive an XMR address where you will need to pay the requested amount of Monero. -4. After you pay and the payment is verified, you will receive a decryption tool and a key which will restore all your files and your computer back to normal.
Emails
Targets
-
- Target sqlservr.exe
- Size 1.8MB
- SHA256 61c47effdf6b6eafd20e74a8a6b52da09e082fefef31c6ae4a2046b6a756050e
Score10/10-
Clears Windows event logs
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s)
-
Modifies WinLogon