General

  • Target

    d25kYWttd2thZAo.exe

  • Size

    83KB

  • Sample

    211212-qh67zsdedj

  • MD5

    7ade88674690aa74970c12608b23bb30

  • SHA1

    6522ee8ccc93ce3abec0a77a1732c15bb16a7ba0

  • SHA256

    6eeb20cc709a18bf8845f7b678967b7f0ff96475cf51a261da87244886bbfd2e

  • SHA512

    8849c9bfb8a7221c60ce1615e65e6af6c77739f1c5696a0d37ddcad374b8564e756373a20a27b5cb4f2c079b87111e26805bf857f22f57ce787f848a35522aca

Score
10/10

Malware Config

Extracted

Path

C:\restore_file.txt

Ransom Note
------------------------------------------------------------------------------- ----------- [ Hello! ] -------------> ****BY BLUE LOCKER**** What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted from your network and copied. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - a universal decoder. This program will restore your entire network. Follow our instructions below and you will recover all your data. If you continue to ignore this for a long time, we will start reporting the hack to mainstream media and posting your data to the dark web. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. email us. How to contact us? ---------------------------------------------- You can choose one of them: email : hyebwma@protonmail.com qtox : 24C0CF90893D73BE99427731EFBA1A11C015D574EC433EA44908B6B6F20FB34AF56622F8A4E8 (download client from https://tox.chat) jabber : hsbwabwy@xmpp.jp (download client from https://www.xmpp.jp or https://xmpp.org/software/clients/ ) !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!
Emails

hyebwma@protonmail.com

hsbwabwy@xmpp.jp

URLs

https://tox.chat

https://www.xmpp.jp

https://xmpp.org/software/clients/

Targets

    • Target

      d25kYWttd2thZAo.exe

    • Size

      83KB

    • MD5

      7ade88674690aa74970c12608b23bb30

    • SHA1

      6522ee8ccc93ce3abec0a77a1732c15bb16a7ba0

    • SHA256

      6eeb20cc709a18bf8845f7b678967b7f0ff96475cf51a261da87244886bbfd2e

    • SHA512

      8849c9bfb8a7221c60ce1615e65e6af6c77739f1c5696a0d37ddcad374b8564e756373a20a27b5cb4f2c079b87111e26805bf857f22f57ce787f848a35522aca

    Score
    10/10
    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

File Deletion

1
T1107

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Impact

Inhibit System Recovery

1
T1490

Tasks