2c895d282fa795252bb859323040e62af0087e626244a9768eca8089ce25291f

General

Target

hptestu.exe
Size

662KB
Sample

211012-qh43macchk
MD5

1f7b5c64fdc506bb5384b938c141d050
SHA1

ae1b5233145eb28c0e0b34d92da9c9b93efe73a0
SHA256

2c895d282fa795252bb859323040e62af0087e626244a9768eca8089ce25291f
SHA512

0309dec997b0c73177f97616afccacbce102c1b64aa6b71ccf0f8a370ce4e2633693a2b7a16f3f663be6f3a042d712ff9ba6e387b07e8cebdb1fafbb37e54231

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\README_encrypted.txt

Ransom Note

ATTENTION!!! ALL YOUR FILES HAVE BEEN ENCRYPTED YOU WILL HAVE TO PAY 1 Monero (https://www.getmonero.org/get-started/what-is-monero/) TO UNLOCK YOUR FILES. PLEASE GO TO http://t2tqvp4pctcr7vxhgz5yd5x4ino5tw7jzs3whbntxirhp32djhi7q3id.onion/register IN TOR BROWSER (https://torproject.org/download/) AND NOTE DOWN YOUR REDEEM ID AND PAYMENT ADDRESS. AFTER THEN TRANSFER 1 Monero TO THE PAYMENT ADDRESS (https://www.getmonero.org/resources/user-guides/make-payment.html). GO TO THE PAGE AGAIN AND CLICK THE "To redeem a payment, click here" LINK AND TYPE YOUR REDEEM ID THEN CLICK "Check payment". AFTER THEN AT THE UPLOAD PAGE SELECT THE metadata.bin FILE IN YOUR USER FOLDER AND CLICK "Get decryption keys" AND DOWNLOAD YOU DECRYPTION KEYS. PLEASE DO NOT ATTEMPT TO USE THIRD-PARTY DECRYPTION SERVICES. THIS WILL RESULT IN YOUR FILES PERMANENTLY LOCKED. THIS SOFTWARE USES STATE-OF-THE-ART ENCRYPTION ALGORITHMS USING X25519 AND ChaCha20 ENCRYPTION ALGORITHMS. ONLY OUR DECRYPTION SERVICE CAN UNLOCK YOUR FILES.

URLs

https://www.getmonero.org/get-started/what-is-monero/

http://t2tqvp4pctcr7vxhgz5yd5x4ino5tw7jzs3whbntxirhp32djhi7q3id.onion/register

https://www.getmonero.org/resources/user-guides/make-payment.html

Targets

- Target
  
  hptestu.exe
- Size
  
  662KB
- MD5
  
  1f7b5c64fdc506bb5384b938c141d050
- SHA1
  
  ae1b5233145eb28c0e0b34d92da9c9b93efe73a0
- SHA256
  
  2c895d282fa795252bb859323040e62af0087e626244a9768eca8089ce25291f
- SHA512
  
  0309dec997b0c73177f97616afccacbce102c1b64aa6b71ccf0f8a370ce4e2633693a2b7a16f3f663be6f3a042d712ff9ba6e387b07e8cebdb1fafbb37e54231
Score

10^/10

ransomware spyware stealer
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Modifies extensions of user files

Reads user/profile data of web browsers

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2