General

  • Target

    rdmr_3.exe

  • Size

    1.8MB

  • Sample

    211019-ynec6ahcbr

  • MD5

    00c227b93837e5e5f7f24509459a0216

  • SHA1

    8148f3df22b82dbdf664ff5e343bb053f01830b7

  • SHA256

    0d93bc5a94ff11a3221e186b6fe8ee28aed9f2f1db2413e6562f43bc7f23786f

  • SHA512

    574b1fdc7505aa597b078828d7559982e4b506c49466f2600b0dfcf4ba3584581df35e5c7baa91ddda97052c6e34d146d8d1e0457269f18ac7799deb9ef069db

Malware Config

Extracted

Path

C:\Read Me.TXT

Ransom Note
8888888b. 888 888 Y88b 888 888 888 888 888 d88P .d88b. .d88888 .d88b. .d88b. 88888b.d88b. .d88b. 888d888 8888888P" d8P Y8b d88" 888 d8P Y8b d8P Y8b 888 "888 "88b d8P Y8b 888P" 888 T88b 88888888 888 888 88888888 88888888 888 888 888 88888888 888 888 T88b Y8b. Y88b 888 Y8b. Y8b. 888 888 888 Y8b. 888 888 T88b "Y8888 "Y88888 "Y8888 "Y8888 888 888 888 "Y8888 888 Made by Cerebrate - Dread Forums TOR [http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/] [Q1] What happened, I cannot open my files and they have an odd extension? [A1] Your files have been encrypted by Redeemer, a new ransomware operation. [Q2] Is there any way to recover my files? [A2] Yes, you can recover your files. This will however cost you money in XMR (Monero). [Q3] Is there any any way to recover my files without paying? [A3] Without paying it is impossible your files. Redeemer uses most secure algorithms and a sophisticated encryption scheme which guarantees security. Without a proper key, you will never regain access to your files. [Q4] What is XMR (Monero)? [A4] It is a privacy oriented cryptocurrency. You can learn more about Monero on getmonero.org. You can view ways to purchase it on www.monero.how/how-to-buy-monero. [Q5] How will I decrypt my files? [A5] Follow the general instructions: -1. Buy 32 XMR. -2. Contact aloop@protonmail.com and send the following key: -----BEGIN REDEEMER PUBLIC KEY----- OTGmo9caCtb5ZQm7jp07g54cTviSAkZNGTlKSw0bMGGNhRtyRN O+Z361jnoEdIyRTuuHxm/gw/Kr+oVHOGzsDFOaZQOu3VrC+Y5U F5JenNtKAvMNEJnggiWiCzJommGWhU4oKJZMBRsx3uT3HVD9X9 4ZlPBXVc/khMWDpQSMSBtlfMTBsbq2bsea2erKdDslvN+RFP95 u7wSeX0AKTfrM8+4X0p8jvADpZrYvngm0hCdmol25uf5Kg3/P2 IRdVg45ZyG3BzTN9inBBBpgx7bXrVxMdKFNDgXUoOi7qoHwO1w 25nbsh4OAwhDx/LyGDI1rUaw4vKwjkMITinbh8f00WfYo3WaII In2VMMZdtmbbsTAnMdpx4VpjYULfWjy+Unoqfl2yL+bHJ+HPqo 3p4M31i/jJf0eCA4QQHMoHs3GwD7OTUMiFW8pdDLRynAxp0Ft/ hzlBpvLWQpsXzWK4kuLIin9hkZ+299qM8Jal8d2rWjjcvnPxVu lhNQGMzvkhaHYJDOmNxADmmeqHGriAYsQ+Gj2yyYu+sPcmzHRQ 0GPL0oaX9FJEFY8y865yF6ttzzdUeGGvkYcWw76MS+S4hKP+JP lAbN685WLF7eBlVpQHYl55ctH+wCAFn7ZkFOw6kSNYrKuttDtg nZyNciSJZdwb8R8fTZMU/3pad6sJr+oOh9Jw== -----END REDEEMER PUBLIC KEY----- -3. You will receive an XMR address where you will need to pay the requested amount of Monero. -4. After you pay and the payment is verified, you will receive a decryption tool and a key which will restore all your files and your computer back to normal.
Emails

aloop@protonmail.com

Extracted

Path

C:\Read Me.TXT

Ransom Note
8888888b. 888 888 Y88b 888 888 888 888 888 d88P .d88b. .d88888 .d88b. .d88b. 88888b.d88b. .d88b. 888d888 8888888P" d8P Y8b d88" 888 d8P Y8b d8P Y8b 888 "888 "88b d8P Y8b 888P" 888 T88b 88888888 888 888 88888888 88888888 888 888 888 88888888 888 888 T88b Y8b. Y88b 888 Y8b. Y8b. 888 888 888 Y8b. 888 888 T88b "Y8888 "Y88888 "Y8888 "Y8888 888 888 888 "Y8888 888 Made by Cerebrate - Dread Forums TOR [http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/] [Q1] What happened, I cannot open my files and they have an odd extension? [A1] Your files have been encrypted by Redeemer, a new ransomware operation. [Q2] Is there any way to recover my files? [A2] Yes, you can recover your files. This will however cost you money in XMR (Monero). [Q3] Is there any any way to recover my files without paying? [A3] Without paying it is impossible your files. Redeemer uses most secure algorithms and a sophisticated encryption scheme which guarantees security. Without a proper key, you will never regain access to your files. [Q4] What is XMR (Monero)? [A4] It is a privacy oriented cryptocurrency. You can learn more about Monero on getmonero.org. You can view ways to purchase it on www.monero.how/how-to-buy-monero. [Q5] How will I decrypt my files? [A5] Follow the general instructions: -1. Buy 32 XMR. -2. Contact aloop@protonmail.com and send the following key: -----BEGIN REDEEMER PUBLIC KEY----- NzaJFJgPWKxTXBO+KIEgZCxcMhSY8ZVM6JZj4ANMtr+FLRCDar wRC6/9thIhlrgN3Rn0pG3w/nNv/+L40n6DPpubWLqwuFAcrpoq unujNCGmdwamZUsPhV1l7HMLASXTx27tGyGkJfXoN2Y1/8gQ8W HOQ+MIyCzKU0dDkN/ifGmw6+GZrk7KOEDj0nlWtbLWHekZLs9c Fu0bh3NskwnwQzgzvh8Mk6Bngi+HXhp9IVSy13qlG+Vxmb3Xqa 91nRuf5ehsXEF756G5vC1khfqxYCoTidhQarEueQkNzZwjyKyo LkL+KxlqhDaeOq82sypzuI0Y7o5m0pY9194NM1z1wxHhWovGeL 6sNtrk9MBz2o3G9UrDn1H3LBrvkW2Fd04wVD1x+xkoiv2UBxB5 Is+OnmXUmGD6Mq1TqsVoljGlVV3PgOSPfT8nNNyEuHdEru+B7a dvjsq48/2p/PIR2zRhcHZVsE7WmiU1IP0ErWVq2B+wBZJjkM0F SkSIefMv9pV+tixsrD+FlmuDCAB12VTipcEkuRLiT8GAWAyAEF d11MAmomJc0aNfRp2230Ki6iISyihGntK2u84sQaDQXQfyO+RU TdonPgGGqY25r95GLV3WABiSPmDJCbIJ3IjTOgbQLVWCf6eWoz BhMHI2RASREC0eH4t+v+E2O7ExENzaBYS8Pw== -----END REDEEMER PUBLIC KEY----- -3. You will receive an XMR address where you will need to pay the requested amount of Monero. -4. After you pay and the payment is verified, you will receive a decryption tool and a key which will restore all your files and your computer back to normal.
Emails

aloop@protonmail.com

Targets

    • Target

      rdmr_3.exe

    • Size

      1.8MB

    • MD5

      00c227b93837e5e5f7f24509459a0216

    • SHA1

      8148f3df22b82dbdf664ff5e343bb053f01830b7

    • SHA256

      0d93bc5a94ff11a3221e186b6fe8ee28aed9f2f1db2413e6562f43bc7f23786f

    • SHA512

      574b1fdc7505aa597b078828d7559982e4b506c49466f2600b0dfcf4ba3584581df35e5c7baa91ddda97052c6e34d146d8d1e0457269f18ac7799deb9ef069db

    • Clears Windows event logs

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Modifies WinLogon

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Winlogon Helper DLL

1
T1004

Hidden Files and Directories

1
T1158

Defense Evasion

Indicator Removal on Host

1
T1070

File Deletion

2
T1107

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

2
T1490

Tasks