General

  • Target

    sqlsrvr.exe

  • Size

    1.8MB

  • Sample

    211019-ynp5nagda4

  • MD5

    e1338c42da2d2363afbbd0eeabad1ca9

  • SHA1

    fe5d669b732c9227bb25787083906f49b732c335

  • SHA256

    61c47effdf6b6eafd20e74a8a6b52da09e082fefef31c6ae4a2046b6a756050e

  • SHA512

    bcc887777c3bcb778000893c15357abcc9a78009a1cd8ae325de787a918d98ded1100fe9b21b79b16fe1d44d5d9fe0147292164ff36cf12a13e9e31b02ed372a

Malware Config

Extracted

Path

C:\Read Me.TXT

Ransom Note
8888888b. 888 888 Y88b 888 888 888 888 888 d88P .d88b. .d88888 .d88b. .d88b. 88888b.d88b. .d88b. 888d888 8888888P" d8P Y8b d88" 888 d8P Y8b d8P Y8b 888 "888 "88b d8P Y8b 888P" 888 T88b 88888888 888 888 88888888 88888888 888 888 888 88888888 888 888 T88b Y8b. Y88b 888 Y8b. Y8b. 888 888 888 Y8b. 888 888 T88b "Y8888 "Y88888 "Y8888 "Y8888 888 888 888 "Y8888 888 Made by Cerebrate - Dread Forums TOR [http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/] [Q1] What happened, I cannot open my files and they have an odd extension? [A1] Your files have been encrypted by Redeemer, a new ransomware operation. [Q2] Is there any way to recover my files? [A2] Yes, you can recover your files. This will however cost you money in XMR (Monero). [Q3] Is there any any way to recover my files without paying? [A3] Without paying it is impossible your files. Redeemer uses most secure algorithms and a sophisticated encryption scheme which guarantees security. Without a proper key, you will never regain access to your files. [Q4] What is XMR (Monero)? [A4] It is a privacy oriented cryptocurrency. You can learn more about Monero on getmonero.org. You can view ways to purchase it on www.monero.how/how-to-buy-monero. [Q5] How will I decrypt my files? [A5] Follow the general instructions: -1. Buy 02 XMR. -2. Contact helpdecryptmyfiles@yandex.com and send the following key: -----BEGIN REDEEMER PUBLIC KEY----- MDOJ4SNegjzjos0DR8AZPMS2fhoBbCYNI6DkHo0KpjT7I0w9tF Em+Tem8spf8YpVrmN1CFm6zN1PgnMTLg07grAd6Bx9Q2KZUZK0 4tyGKy9g56Mn4/cSGBKSN2J7wHnk8/U3+z7F9R+WyQd4VAQqPz aD6vrs3j6kJHOIVarV2yhDiAaQvw6z8ZJWTcC7/1oJ7RA1Qhco Fw35kICAJK9+UqMkUZp4bbC2+diaiy6mi6YCHb8yNkv4WzrX5N MmCha0ZEE1RAv0fb44D2OjvJx2e/DdzHjuiOSdosF4uyq/pN+0 p2NA2Qa+7CerttH35eByXP0SIS3bp2gY2VJmPh+5lRm9Xc63rw 2+j+KzbMuWQfeKHwe4PVpxapiGSupELnZCft1ZifIm6Soizj2W UWFjJJw721HvBQl9nvEmTawghHBxE+PXJgUJi/ENqz9+vgPC2K HusiGs4QPt4OT/BahWLNW2bXj2uQfiw8OgugageNXHb2GM+rT7 Hg1eTaD8J1xE/1HiaxlQjJLFY1ywZtx4p1FcvgRaJNlmag4Nxb hy7e0cmGScrrSPcCysGjKQiEpqU2Bktop3N5eaKTLOFzQHRz3p asFA0VdKneojvAor8vyKqlJChLcAQMr2xKKskJgb693fcouZ4I hDSpHxwqoKOZDe7H0U3YBcKH0u/SEGiEa12w== -----END REDEEMER PUBLIC KEY----- -3. You will receive an XMR address where you will need to pay the requested amount of Monero. -4. After you pay and the payment is verified, you will receive a decryption tool and a key which will restore all your files and your computer back to normal.
Emails

helpdecryptmyfiles@yandex.com

Extracted

Path

C:\Read Me.TXT

Ransom Note
8888888b. 888 888 Y88b 888 888 888 888 888 d88P .d88b. .d88888 .d88b. .d88b. 88888b.d88b. .d88b. 888d888 8888888P" d8P Y8b d88" 888 d8P Y8b d8P Y8b 888 "888 "88b d8P Y8b 888P" 888 T88b 88888888 888 888 88888888 88888888 888 888 888 88888888 888 888 T88b Y8b. Y88b 888 Y8b. Y8b. 888 888 888 Y8b. 888 888 T88b "Y8888 "Y88888 "Y8888 "Y8888 888 888 888 "Y8888 888 Made by Cerebrate - Dread Forums TOR [http://dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion/] [Q1] What happened, I cannot open my files and they have an odd extension? [A1] Your files have been encrypted by Redeemer, a new ransomware operation. [Q2] Is there any way to recover my files? [A2] Yes, you can recover your files. This will however cost you money in XMR (Monero). [Q3] Is there any any way to recover my files without paying? [A3] Without paying it is impossible your files. Redeemer uses most secure algorithms and a sophisticated encryption scheme which guarantees security. Without a proper key, you will never regain access to your files. [Q4] What is XMR (Monero)? [A4] It is a privacy oriented cryptocurrency. You can learn more about Monero on getmonero.org. You can view ways to purchase it on www.monero.how/how-to-buy-monero. [Q5] How will I decrypt my files? [A5] Follow the general instructions: -1. Buy 02 XMR. -2. Contact helpdecryptmyfiles@yandex.com and send the following key: -----BEGIN REDEEMER PUBLIC KEY----- NzVC7makqkwG9LP3D4IPTZSILwpVc5I8oDPB49BgWzamObWMQI dGgVXgMOc199uuc3SFJO7Egfu7LGIl5TB8eZpG/6Xa29XSDHGj UR/UoECaSVhz34NQ3xCKQ5N+FTA06rs8YGfmtutjLKhs6rwtA4 G6taUOM+VbLbx0CH8Bz0203kotIB9LVJ+Ilty1G3x6kgUZlWKQ jTJP9kF3dBNzAQUB2dedovqGo6KESBd3Y1IFFb1ismR5+rHooe FXwjyYhuJ9Mq0AZLnLwu8r5aSaR1Io0HiWBJd6DcvA3t8VXmcf /QsbjFr/h3MM77zNSswLuTOmD17HZjZR53UWbBMJkBzT3IPdUJ Z67A/Tzu7T2/wq4c9kDBOUgp/6iOLiAtnUVN5C1MVa24GN3z7F CjinB0Iq18FDt+XqOcSEFhFZcuG2kIWvfZy+eSbx8bD01f8Bpw 8ipMm/c92WupSvi72JULiEYU++m3iNhEL45rwLLIoDfvRbMEyX Y+t4LTwCromV6jigXpLl4QxYwMP8SOoAl5y7upELdVm2ej1igw 0oZgsFIpjrUQxa6Iq22WGTByxFCWmkFVm0dJL8xvZovmD9BJ8G Rf8mpzeheX6GTYSRBGK1/JyB3NVoZzvDy002bH4kC63qU6PBGo hvZjP4b15CKzc8hETEqYUBl5wnQbXJg+hwdA== -----END REDEEMER PUBLIC KEY----- -3. You will receive an XMR address where you will need to pay the requested amount of Monero. -4. After you pay and the payment is verified, you will receive a decryption tool and a key which will restore all your files and your computer back to normal.
Emails

helpdecryptmyfiles@yandex.com

Targets

    • Target

      sqlsrvr.exe

    • Size

      1.8MB

    • MD5

      e1338c42da2d2363afbbd0eeabad1ca9

    • SHA1

      fe5d669b732c9227bb25787083906f49b732c335

    • SHA256

      61c47effdf6b6eafd20e74a8a6b52da09e082fefef31c6ae4a2046b6a756050e

    • SHA512

      bcc887777c3bcb778000893c15357abcc9a78009a1cd8ae325de787a918d98ded1100fe9b21b79b16fe1d44d5d9fe0147292164ff36cf12a13e9e31b02ed372a

    • Clears Windows event logs

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Modifies WinLogon

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Winlogon Helper DLL

1
T1004

Defense Evasion

Indicator Removal on Host

1
T1070

File Deletion

2
T1107

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

2
T1490

Tasks