General

  • Target

    c3948757555796fe68e49b01f14c83215989486b5feca5c22ed970423a8fae06

  • Size

    134KB

  • Sample

    220124-bg6gqshcd5

  • MD5

    f278d8ac3f13e4cedb12071e36192d84

  • SHA1

    bef5000146d4d25db641c35f3473083d9786b959

  • SHA256

    c3948757555796fe68e49b01f14c83215989486b5feca5c22ed970423a8fae06

  • SHA512

    697a87379ebb00917a4563b6ee5892128dcf366cfdb9e29a1a7137dd4d45b259ee09a314e1efac12bb5f03054849eed552fff08d2f28089753c24f0d863f903e

Malware Config

Extracted

Path

C:\yi49308h-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats Happen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension yi49308h. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [-] What guarantees? [-] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] Using a TOR browser! 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2C3E333CB0B376C9 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: DZxJTCquJVeWIKKwNOR4TL7eCiS8yKqClYvpCjWe8ZPxkM8ZpPdZDTdlnsMbBzxH /axb39Axa3Lw+2IszgMcvIo1lR1aXPrlMb0zEqUR7CXKG2bs6YX7XACY0Rrq5mx0 AXvv6kT5XWd6r/NFEsv+UNcU3i1sZYFs2LN7Y8gKQ0+ctXdextKXnlCWhKM41dp3 H3pez3pLsb74QZdEL1T1AvgSpaU1a7ibnFbCWbz1ZIGOACqIJEbLudYJnb4RnzK1 EDKSjQBtrPys+3OxfAElJY8d8FaKskC1ghV3eXHupMz/CN1aItSJDhwJSFbWIc6d KhB1O8X2rA3fO/BZcR62ongUR2cXgYgD2SGiin1svTBPTZC1hGlfG4IdLKe2BEGZ rXxwWOZ/cY6Ynb2a5RaESrciJpWLY0gHfMfg+h5Hdg+AUk+411ZiO2i4P9Xk4jNW 8eNTzxyHJPFkZikKT7iJaZ8UK8K9EI56GCQ0amqVX18HWK0/Y8s1uW50CxE+i2bE GimKmpHsbBHhcxrrvbC2yUunILJXS0TNUZwIGYiI+JZL607WgLc1uCFejwhkJdvW DXvXEyyMEDL4S2hrbWJX0JConiTZH8qc0cvU7iUEOj8HTRFcAPwnsOhfhWetF4Pf /GCUOFekACO+GafR/KgiOFBaKOPHuOlRgtk8D6KXjaUVCC3FuEWu0OnpZFql/CeP geVw9VNmxX4K0beKpPD86usxgYhyJuaa3H2gWQmuvM9S6QDZgUVu1nGihnJRSxJT 1ubYl7IY3dm/JyTIB10YXJcC1aIeaiAqgjXNMoc9Ftm7224dQII1OCNJyxcucjNx ExxUjXyd2mWFRL6q68JrkyLCllHd7sdWZhm8fHZKpdi1rOcCS0qJmQUlfkghcYLV gLLWodNHt2uPjAguF+iksg9B8nTbE2346DbOZD5V0LhDyuzBhGwPf5Mt1mmIyVhs lFJq9dIGojmNI+OAN9zvjZaFDeFpf+GSHMg5k7YD5wl8H2tHrngyN87wHV6fzUdi eP5Q0Ay/J5ScbTfvgQdvUlu27p/LB4Oirb9MhzO1SpETkbjOEx3iAT+DQJwI5U9o UOvyzUDPJOZXu4K9oJeLniSkNeuDT4CQYiugVrzPvjhcBqk5iVod3BhPKf8eHBeS uCfABv2/ST3rNO4wwFmw+MQI7hqjmDkZI3ur5ims88Mp4H7dvmE3dv4hZeU4YuXO Wsjy8yrgZTZuw89sBL3A+k8EAOsLYwu/R4gS14IA7ta3UVVey+eabr9gKGX7cg3k x5BVm8Z7y6uLVis7E5HyQcMn ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/2C3E333CB0B376C9

Extracted

Path

C:\di78h-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats Happen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension di78h. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [-] What guarantees? [-] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] Using a TOR browser! 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A7D0BA0898ECFE2E Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: kZ22oRnDTp8RwpkQYKwFtBOHXNzqWapjTsHkg4naCvnQL2sdvHhNXyik7iYtb+ue WxO589LdlZmrm5VWt7JkmfLg1ocX4HQ4ZzyHdeYucCwcO0zAHfUhQRAeCWhPUNYt /1S7z0numb2IVX9dSIkemmfe7rGLYYVXzysJpzvJLSmuIVoU+O1jU/2QJoYiixFb 1nLokST3VYOFE8OP59neJavwRg5FLtM8A9EHKxWFkVj2v8SAYhu0js+BEmZYsU++ ZC0k5Ovi9WIifBjEqQ8d8vfQiUEtNewBFpSN7a+8p1Uix6aBdKqLkd+YH+Izd88F JeBvmT81M4DieqSzYVUEYpcylhKqKI33ZgEAwN8z2nTq/0qPOAU53TLArTW/NcwY RlvervZ9Bdu/87E952NspoopbiZXfQdZ3e/RqcxR5JQdHzyt12uoKve42Rz7Ohhd xsEwJIXA7iGdEoz3ooYGVSCELCF98yb41ntULyLPj/9LufjqKYV+XNcUqvH3It3f 6UXfpOUek0Tbu3mcla32rjlFs4z9EN1maRRRokF7J3ZHSBWFoscTH4RSxvFFlB7J Fm71sLFaG2ZO9lPT4w7QYNv994g6BlrdpB8DHqUPRfPRxQshccydwysjE1yTYldZ z/aqt46RCuknjKQf9YcW8DKJAHZ7g/ZQHnr17K8JeZ9m8RV2I8Mlw6U1m6JtbKOO yUzhgaHzmiqeuYKtfDYbi7jBdE3Ck+dykgTjTx6wR0TP2fqd8DW0EC57G12az7Cb FbN9nkmnQ5CTAKZMBCpqtlYNz0FV6hmtFygHv9Mdj3hDjfM6l/7QcKY2WiyhLS/y 46z3SmFmTc0JGmgy006SHW16QqzNEync3P5erFMf4B0x3OPy0/UbetIo+9ilHNlQ TVNuwDGmwtfTfN4cVXvmpTgURctknzYf1poVarpIN2StADpCPXle9DH+wZpajvDc +HTLOsN2ftO+z5OyIBNhZ4r7SLqFL2FMypD76nB7Tphv0uT9IHGTRcPbyFtcGUX2 BdH92hGxzs3PJLsA+BfSeQN35adeL7279nbrd+8T5vk4lYMc8iy5fGAoOyzxhgCl xWkelj2IrePFFIgIRsbVFnv3hU8t2XJkZHDkSo3BWdmLPcxllg751vID6PHi6gWs CTb2KOgSTG86Z2WWbBqFVieMhlrFESpgOHItFnrh/aW/xLJf1qyf8yJ14ySIvRVJ u1IPV/xaLUy8ZadQvVHROkaryqEfpGvTP4lkgvmIEjO8e+RsRZZ1asDNSyDCZLn0 nMhm9w== ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A7D0BA0898ECFE2E

Targets

    • Target

      c3948757555796fe68e49b01f14c83215989486b5feca5c22ed970423a8fae06

    • Size

      134KB

    • MD5

      f278d8ac3f13e4cedb12071e36192d84

    • SHA1

      bef5000146d4d25db641c35f3473083d9786b959

    • SHA256

      c3948757555796fe68e49b01f14c83215989486b5feca5c22ed970423a8fae06

    • SHA512

      697a87379ebb00917a4563b6ee5892128dcf366cfdb9e29a1a7137dd4d45b259ee09a314e1efac12bb5f03054849eed552fff08d2f28089753c24f0d863f903e

    • Detect Neshta Payload

    • Modifies system executable filetype association

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Change Default File Association

1
T1042

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Tasks