General

  • Target

    a348b5c399961e01a6455234d26f9f2e171a64e1d2d58d0edf2ee42a72db4c92

  • Size

    844KB

  • Sample

    211128-pkkw4acea8

  • MD5

    8c41ec60e1c3b16d51f7acc6f8947d57

  • SHA1

    b2b874522cc8013b24d7fe3b5a44b45dc735831b

  • SHA256

    a348b5c399961e01a6455234d26f9f2e171a64e1d2d58d0edf2ee42a72db4c92

  • SHA512

    a9584b54e7d1fc3b9d30acc5c1376c2670edd26f3ce255a8a747fc7885e0168021fcb0eac7c46a7d258ac37c4f3aa92949597cd2cbd7fd6017259d23a004d321

Malware Config

Extracted

Family

djvu

C2

http://tzgl.org/lancer/get.php

Attributes
  • extension

    .robm

  • offline_id

    Z5GGASEfY71jtxU3i3E8kzvrTJmY9oiZkjcSm0t1

  • payload_url

    http://kotob.top/dl/build2.exe

    http://tzgl.org/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-Tjb0YqckGX Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0354gSd743d

rsa_pubkey.plain

Targets

    • Target

      a348b5c399961e01a6455234d26f9f2e171a64e1d2d58d0edf2ee42a72db4c92

    • Size

      844KB

    • MD5

      8c41ec60e1c3b16d51f7acc6f8947d57

    • SHA1

      b2b874522cc8013b24d7fe3b5a44b45dc735831b

    • SHA256

      a348b5c399961e01a6455234d26f9f2e171a64e1d2d58d0edf2ee42a72db4c92

    • SHA512

      a9584b54e7d1fc3b9d30acc5c1376c2670edd26f3ce255a8a747fc7885e0168021fcb0eac7c46a7d258ac37c4f3aa92949597cd2cbd7fd6017259d23a004d321

    • Detected Djvu ransomware

    • Djvu Ransomware

      Ransomware which is a variant of the STOP family.

    • Modifies file permissions

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks