General
-
Target
svhost.bin.zip
-
Size
283KB
-
Sample
211208-r9e39ahbdq
-
MD5
9efc99d749017c5534c66800e3759fe1
-
SHA1
95430f2590fb5e851e27ff97de2b17e8c98820db
-
SHA256
60b47bcd773f75c3baa2aa39e98a1b691653396237cbe4aa12eb3129011d83cb
-
SHA512
b63187da1fc769635b76661f9e6c544d85a428eabe68711b751ce760198536ada030fbdde9a7ab0ebecded6da47a69f94e04b00a6faa116279e6f8e202408158
Score
10/10
Malware Config
Extracted
Path
\??\Z:\Boot\HOW_TO_RECOVER_DATA.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">3BAD2413F203AF7EF46E3028211DE3A1F9FB089086146C12D30C86F0ABA373BBAF3337F47D66DBEE259DE648876F1DD321888DDA5D86C77332330AEB2CF835A3<br>AD5859D4DF0E62F2231C522156582D96921606BC7526D5BAB7C6C21C41F7E28875EB652B704E8316B4CDEF3B35361D9487FA8F673AD303FE43711AC1699C<br>EBABB5B2AB05C1F1E3DF1E791FF25538770764C18FCF64D35959F62CB9C3F97485B36A1E14CC9070BE7A7EDF6F5DD410B338256FEC09C323D36C60935B36<br>52C28C39BBA576FD897723A13CF342CB93218D86A17311078D0FBFB46F21167B14317ABC22FD109870C49F9694AB6FD51D3B2DF7773B72C7D8D1CF57C07D<br>12070A4D6C8388212F1202A601BBA40ACAB8B5A76E428216B201B031D0D3483A48629F2C3BA8C3DEFD83C0169CD91C00477B7DD72086626FF5FC0C91AEF8<br>8FF62766F1F68C7594372510FE0F4E896895DC511CAED5D9E1003ACD2338C9C27A0AEAA9F01DD75D4681F0BA69D304EFD6AC263FCBAEDFB927BE42C6A284<br>54356EBAA4BA40388F9165A326C80A1DE4355AB63A272E234D537EB901F65638DD511B64A51991AABF7B7778A10672CA9438DD4C285733AB71C1D0F43140<br>C9F74A503AF0ABE42992376023692AFE2B225FA45DC76E72E679C389FEA9C793947B9B1CCC4794F93A1248FDBFC3685C6502D999858ABF8C804F91F61900<br>4FCCFD7B844E45647228E74A0B25</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>.onion</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open <a>.onion<br>
</a>
4. Start a chat and follow the further instructions. <br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href=" [email protected]">[email protected]</a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Extracted
Path
C:\Boot\HOW_TO_RECOVER_DATA.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">88AF813DB2666FB70367F1B1F10249ECB5C1BBFA2D39FECECFE00CA3FC56752D3A5D7B5021068DCA33F8B9020477567616290C5AFB8D678650964A54BEB6355A<br>A61B5F5353C1DAFAB366922EE7CD28EDCD46DD5EB94C7B6250AD07E7A4AC285788B1644D202F45F5B8E790C175BA9C0647435D94DC3734642EB45C3E0683<br>99574DD9AB3F7C568A0F61916FA22FCC0001436499A4AA89622D91B47FBDF926A59B8F3D3895B6CD411D61722C7CD3CDAE28D29F355A0923B8958C9F36C6<br>50790B462A6C23D4B36BCE5A3092ADE48756BE4A6E31E6D33E912C5D192B1D77B72A460ECE8AC5E861DDBBB8DE20B05937E3942D39BBE6615CCA02FDC4C9<br>DFE93DCAA53C4786C328DA3FE767076001151AD4AC034E64B408A868C64C5F3B58C4A506BDDD5FC86622121EEF7F2C1AE23905500277A3774CB2BA6C6BFC<br>259FEDE91FE01FA4DC4BDC75CCD79824397A0A688DB4788C54752CC8ED5DC31A4E375D2B2727E0A54BB1F4A8C49327568A73CF4F57D70DFDA6DD89591A0E<br>62476E9205C16DEA194B2B5ADE635B6D9516199ECB6EB89781214A4775D2C089851652C6CB7C8148909F6DB1D9FFE1F4BAAAC4B20134468B3DE87F63726B<br>EDBAA69E0C93601415683F7ADF6CC38B8EA10CF5E425159F48745DE5FFE86B0043F038219C968E7B364D6985172427A5466B657F2E76FC5CD2481A024841<br>23698F44307AA66D47ED91130F19</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>.onion</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open <a>.onion<br>
</a>
4. Start a chat and follow the further instructions. <br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected] ">[email protected] </a> <br>
<a href=" [email protected]">[email protected]</a> <br>
<p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br>
<b>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
Targets
-
-
Target
svhost.bin
-
Size
669KB
-
MD5
ed7d859df562c7679dfcb14ee359ff2a
-
SHA1
cde2bfc546f6fc85bcdf5d35bfbd2d17d5c7c91c
-
SHA256
c2a78b419e7d33de9e7418306f30623970a02d4d41c562e99581d0dc3e0bdb08
-
SHA512
730c6940dc83f071cb65ebc3dacde8ddde5147e722cdb027d3feb8fe42bf7b6b0f699ff8b744b7f0dc0ca0fd6762b42acee4b2d67220b637cee0c82ae893bf80
Score10/10-
LockFile
LockFile is a new ransomware that emerged in July 2021 with ProxyShell vulnerabilties.
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker Payload
-
UAC bypass
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-