rbs.exe

General
Target

rbs.exe

Size

53KB

Sample

211020-q1pqnaaadk

Score
10 /10
MD5

c6edb2242607a0e09ac7cddc4d65443f

SHA1

8a09c4f1b8c930b6f3fff304e4fc6dc12639820d

SHA256

4ef4c2b02aeef11ca823584186903598cdf844eb1d089ca94c2aedd776e901cd

SHA512

4a79134da78fdf5e11323ad234764c48adc6c7269d7814b8e17373971d3de101e048a7975fb47bf946b6df71f94885ef80ded8903bf31fae49a8e5d21433d692

Malware Config

Extracted

Path C:\how_to_back_files.html
Ransom Note
<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">����������06 8E C3 5F 1D 1B 60 96 D9 3D D0 08 1C 01 A6 0F 28 CC A5 C7 2F 18 36 BA 06 8C 9B F3 38 45 71 7F 1E 04 61 82 8B 27 F3 60 DE BC 58 57 09 3F 63 34 E0 04 2A E1 48 11 11 3A 28 D2 03 B2 C2 6E 41 97 11 9E 4A F7 9D A7 E0 5E 60 CA 75 01 D0 4B 8F D5 DB 78 72 E3 01 D8 33 E3 9A C4 C5 E2 97 10 5B 0A 1B E8 9E 29 AD DD 03 47 F3 0D B2 26 27 E1 CC 86 09 D9 F9 79 EF 91 29 F0 80 26 9D A1 62 57 1D CB 80 99 B0 F5 0C 4D E6 4A 0C A8 AD 5E 7C 75 29 DC C9 99 1D 37 0A 4B 25 1B B0 F7 67 05 04 97 F0 1C 79 61 71 E3 EA 89 4A 1E 5C AD BE 30 8E 98 A1 F5 A8 65 B0 01 F1 57 EE 55 56 5A 42 19 9D DF D8 BF D5 1E E2 3E CB E1 3F 2F 52 24 56 45 9C 7F C4 3A 03 12 EA 25 26 FA 63 19 A6 D7 5A 40 22 79 D7 52 67 AF 53 0B AD B8 93 D9 73 63 64 61 6B C7 33 51 93 47 CB 6C 05 DE 8A A9 E8 C9 64 F1 DE 1F F3 74 </span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>.onion</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open <a>.onion </a><br> 4. Start a chat and follow the further instructions. <br><br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="help_24_decr1@outlook.com ">help_24_decr1@outlook.com </a> <br><a href="help_24_decr2@outlook.com">help_24_decr2@outlook.com</a> <br> <b>* To contact us, create a new free email account on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html> ���������
Emails

href="help_24_decr1@outlook.com

">help_24_decr1@outlook.com

href="help_24_decr2@outlook.com">help_24_decr2@outlook.com</a>

Targets
Target

rbs.exe

MD5

c6edb2242607a0e09ac7cddc4d65443f

Filesize

53KB

Score
10 /10
SHA1

8a09c4f1b8c930b6f3fff304e4fc6dc12639820d

SHA256

4ef4c2b02aeef11ca823584186903598cdf844eb1d089ca94c2aedd776e901cd

SHA512

4a79134da78fdf5e11323ad234764c48adc6c7269d7814b8e17373971d3de101e048a7975fb47bf946b6df71f94885ef80ded8903bf31fae49a8e5d21433d692

Tags

Signatures

  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup Folder Modify Registry
  • Drops desktop.ini file(s)

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Privilege Escalation
                      Tasks

                      static1

                      behavioral1

                      10/10