Resubmissions

23-10-2021 13:49

211023-q4pj3acda6 9

27-09-2021 16:25

210927-tw86aahecn 10

27-09-2021 16:15

210927-tp7c4shebk 10

25-09-2021 21:37

210925-1glj1adhh7 9

24-09-2021 00:57

210924-bbd6asfdgj 10

24-09-2021 00:56

210924-bad4xafdfr 9

General

  • Target

    APP.exe.zip

  • Size

    5.2MB

  • Sample

    210927-tw86aahecn

  • MD5

    4f3669edb010f5db21b13a088182b8fe

  • SHA1

    892447e55ff7a3ac5d26c573bb8eb4607b41ba1e

  • SHA256

    b70b9039ec4b33987a991c5c20729eb3310d7406b8d15161037df3b21fd968bb

  • SHA512

    a6c1911bd010c13630b9921fefbfd5a495ed3786e347c208602f25bd9e8f49be28d6711a971bd74f87f303bd312862fea730483045fd4b74410c76e9fbe59ea7

Malware Config

Extracted

Path

C:\Users\Admin\HOW_TO_RECOVER_FILES.Colossus.txt

Ransom Note
[+] What's Happened? [+] Your files have been encrypted and currently unavailable. You can check it. All files in your system have "Colossus" extension. By the way, everything is possible to recover (restore) but you should follow our instructions. Otherwise you can NEVER return your data. [+] What are our guarantees? [+] It's just a business and we care only about getting benefits. If we don't meet our obligations, nobody will deal with us. It doesn't hold our interest. So you can check the ability to restore your files. For this purpose you should come to talk to us we can decrypt one of your files for free. That is our guarantee. It doesn't metter for us whether you cooperate with us or not. But if you don't, you'll lose your time and data cause only we have the private key to decrypt your files. time is much more valuable than money. [+] Data Leak [+] We uploaded your data and if you dont contact with us then we will publish your data. Example of data: - Accounting data - Executive data - Sales data - Customer support data - Marketing data - And more other ... [+] How to Contact? [+] You have two options : 1. Chat with me : -Visit our website: http://colossus.support/LPc6EwBqmyC8Tv9Glawleycars/ -When you visit our website, put the following KEY into the input form. -Then start talk to me. 2. Email me at : colossussupport@protonmail.com KEY: MjdhZDUzM2Y3MTVhZmUxZjI2NTk2ZGM4YjVhN2EwMDEzODk2M2ZhNWEzMGU2Mjc5MTU4ODFjYjhiNWE3YTAwMTM4OTYzZmE1YTMwZTYyNzkxNTg4MWNiZmRkNDkwNDhiNzA0MjVhNGU0YTc0N2FhYzY0MWU5MTFjODY3M2RhZGQ= !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software or antivirus solutions to restore your data - it may entail the private key damage and as a result all your data loss! !!! !!! !!! ONE MORE TIME: It's in your best interests to get your files back. From our side we ready to make everything for restoring but please do not interfere. !!! !!! !!
Emails

colossussupport@protonmail.com

URLs

http://colossus.support/LPc6EwBqmyC8Tv9Glawleycars/

Targets

    • Target

      APP.exe

    • Size

      5.2MB

    • MD5

      a0b4d2c96937104bcffd21ce69885a59

    • SHA1

      6cda6e2bee6d67a5f407e4d7e96af9d76bfa7c79

    • SHA256

      72cb50e5791e1fcb11d24bc4cff3b44379a529c5549fbf6f500adcd67bfe9139

    • SHA512

      17b1b4de1bddb7f357744ace07509481e80eb8a63fa9c39ee00ecd7eba3b03611eb0e2329e88e20b05e8a2655fa67a7b699c8455c1fa9aebeba4384151ae2ee0

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Checks whether UAC is enabled

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Tasks