Overview

overview

10

Static

static

8

75e337b7d7...in.exe

windows7_x64

10

75e337b7d7...in.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    75e337b7d7729ce064e11444b9c781f27c4e16cf634a4119908b96385b4b5523.bin

  • Size

    325KB

  • Sample

    211207-z56z6sdaen

  • MD5

    54217c1ea3e1d4d3dc024fc740a47757

  • SHA1

    b59de1e092992e432214b772c4dbe7d839997c3f

  • SHA256

    75e337b7d7729ce064e11444b9c781f27c4e16cf634a4119908b96385b4b5523

  • SHA512

    818dba2878a7126351a6480c2c9233838dbd6b5d3b308893641acad7b1f21b5b61b13d9346ce6d22b9dc0709b4db33f125d9d039580912481e657fd79fda5790

Score
10/10
persistenceransomwareupx

Malware Config

Extracted

Path

C:\How to decrypt your files.txt

Ransom Note
Encrypted Files! All your files are encrypted. Using encryption AES256-bit and RSA-2048-bit. Making it impossible to recover the files without the correct private key. If you are interested in getting is key, and retrieve your files For information on how to reverse the file encryption send email to: airacrop@vpn.tg enter your KEY in the subject or email body. ======================================================= Remember your email is not answered within 24 hours, visit one of the link below to get a new mail contact https://6kaqkavhpu5dln6x.onion.to/ https://6kaqkavhpu5dln6x.onion.link/ https://qsx72kun2efdcli2.onion.to/ https://qsx72kun2efdcli2.onion.link/ Alternative link: http://6kaqkavhpu5dln6x.onion http://qsx72kun2efdcli2.onion To access the alternate link is mandatory to use the TOR browser available on the link https://www.torproject.org/download/download Key: ======================================================= EF0771674764DDAAB32A83F51239B6286FBC61265393AAA051CCC1881942616F =======================================================
Emails

airacrop@vpn.tg

URLs

https://6kaqkavhpu5dln6x.onion.to/

https://6kaqkavhpu5dln6x.onion.link/

https://qsx72kun2efdcli2.onion.to/

https://qsx72kun2efdcli2.onion.link/

http://6kaqkavhpu5dln6x.onion

http://qsx72kun2efdcli2.onion

Targets

    • Target

      75e337b7d7729ce064e11444b9c781f27c4e16cf634a4119908b96385b4b5523.bin

    • Size

      325KB

    • MD5

      54217c1ea3e1d4d3dc024fc740a47757

    • SHA1

      b59de1e092992e432214b772c4dbe7d839997c3f

    • SHA256

      75e337b7d7729ce064e11444b9c781f27c4e16cf634a4119908b96385b4b5523

    • SHA512

      818dba2878a7126351a6480c2c9233838dbd6b5d3b308893641acad7b1f21b5b61b13d9346ce6d22b9dc0709b4db33f125d9d039580912481e657fd79fda5790

    Score
    10/10
    persistenceransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Tasks