General

  • Target

    xd.exe

  • Size

    42KB

  • Sample

    211202-mj8knahhd2

  • MD5

    a034f79273e3f61d34eeadf38f12dee2

  • SHA1

    9c8feeab65f71344713d63f4879e247aba49dce4

  • SHA256

    903c04976fa6e6721c596354f383a4d4272c6730b29eee00b0ec599265963e74

  • SHA512

    f88ae1a3fdc901e49c3ddae6008f80c3b647f2fb88d32c9d726d91f52f65d5af5b2c6c0bdc9dba556f797e9c9075befb4d639a1b6ff990b060bdb081f2945caf

Score
10/10

Malware Config

Extracted

Path

C:\PerfLogs\Hello.txt

Ransom Note
.;tLG008000000GLt:. .1G80Lt;:.. .,:itC08Ci ,f80t: :f88t. 1@0i 188i .C@t .L@f C@i t@f t@t ..,,:::. .:::,,.. C@i .88..CGG000000G8@; 1@0G000000GGL :@G :@G 0@1.... G@: i@L ....f@L .8@. :@C ,G8t:..,i0@1 f@Gi,..:f@C. 0@. :@C iC0000Gf, :fG0000C; 0@. :@C .. :i111;, ... 0@. :@C :L80GCLCG00f, 0@. ,tCGGCt,,@C f@G;. .i0@t 0@,iLGGGLi t@01;;1G@0@C f@t L@1 0@88f;;if@G, :@G ,f0@f, 8@. ,@G iG@Ci ;@L .0@; .iG@f .8@0000000000000@G :08L: .L@1 ,L@G1. :: ,,,,,,,,,,,,,,,,. .:. :L80i ,f88f, iG@C; iG@G; ,f88f, :L801. ;L80i. ;@@8f :08@@. :@C:: .;.0@. ░█──░█ █──█ █▀▀█ ▀▀█▀▀   ░█─░█ █▀▀█ █▀▀█ █▀▀█ █▀▀ █▀▀▄ ▀█ ░█░█░█ █▀▀█ █▄▄█ ──█──   ░█▀▀█ █▄▄█ █──█ █──█ █▀▀ █──█ █▀ ░█▄▀▄█ ▀──▀ ▀──▀ ──▀──   ░█─░█ ▀──▀ █▀▀▀ █▀▀▀ ▀▀▀ ▀──▀ ▄─ Not so long ago, we discovered a serious problem with your network and decided to help you. So what happened? All files are encrypted with Integrated Encryption Scheme. The file structure was not damaged. You have been assigned a unique identifier. After infection, you have 96 hours to declare decryption. After the expiration of 96 hours, decryption cost will be automatically increased. █░█ █▀▀ █░░ █░░ █▀█   ▀▄▀ █▀▄ Now you should send us █▀█ ██▄ █▄▄ █▄▄ █▄█   █░█ █▄▀ message with your personal identifier, which is at the bottom of the message. We hope that you understand the importance of the work we have done, if the vulnerability were found by someone else, it is possible that the consequences of the attack could be much more sensitive than the usual payment of money due to us for work. Free decryption as guarantee! Before paying you can send us 2 files for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information (databases, backups, large excel sheets, etc.). ▄▀█ ▀█▀ ▀█▀ █▀▀ █▄░█ ▀█▀ █ █▀█ █▄░█ █ DO!! NOT!! TRY!!! █▀█ ░█░ ░█░ ██▄ █░▀█ ░█░ █ █▄█ █░▀█ ▄ TO!! CHANGE!! or apply any other influence encrypted files by yourself!!! If you willtry to use any third party software for restoring your data or antivirus solutions - this can lead to complete damage to all files and their irrecoverable loss, since it will no longer be possible to restore them Any changes in encrypted files may entail damage of the private key and, as result, the loss all data. ...!XD :: your personal id: 9889E042B07F83DA :: our TOX below >:) A746E398A5BC9AD9F281F5D10CF861546092D0F2107F12EA9F107EFB7D21CA41F312B73FB114 You can download TOX here: https://tox.chat/download.html
URLs

https://tox.chat/download.html

Targets

    • Target

      xd.exe

    • Size

      42KB

    • MD5

      a034f79273e3f61d34eeadf38f12dee2

    • SHA1

      9c8feeab65f71344713d63f4879e247aba49dce4

    • SHA256

      903c04976fa6e6721c596354f383a4d4272c6730b29eee00b0ec599265963e74

    • SHA512

      f88ae1a3fdc901e49c3ddae6008f80c3b647f2fb88d32c9d726d91f52f65d5af5b2c6c0bdc9dba556f797e9c9075befb4d639a1b6ff990b060bdb081f2945caf

    Score
    10/10
    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Deletes itself

    • Drops startup file

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

File Deletion

2
T1107

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Impact

Inhibit System Recovery

2
T1490

Tasks