netwalker | aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5

General

Target

aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5
Size

65KB
Sample

220201-bs6a4sfcb7
MD5

5326329820103eddbd231b1898816204
SHA1

77557dd9115aa0be7b509b301a526a4234496e37
SHA256

aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5
SHA512

534de02ead299dcdec9cc1aac244a4afe6f1c1b891948aae62e1419c0242ddea9999d0885eb166c6b76a1a068a54ca9ebe3bb6ec239fa4c7348c6ac28b2b1af9

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\ManagedObjects\DAC840-Readme.txt

Family

netwalker

Ransom Note

Hi! Your files are encrypted. All encrypted files for this computer has extension: .dac840 -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and loosing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_dac840: Vuzqs0I7CS8JxO1mJWFio9EvAZ3nf0Pf3cXg/DXROdkOMTNQEo CaFKN5Z9bfwUj3WilFawWhSNRj6lAYVDVC7F63wLda+t8yurP5 y5dAyNrVdN0UJV8himE1qQEG4+WdqkRjpIob597Yesxeq0nmG6 qC9WmzOhNMQ/crHFyEOP89OujelzqAZifTMZtgd8+DTEAaj7lD EsHFqY1fDPWxxc29tTnyooHXaAuIK72h4vT5x6xI5RGOu6n4iq TDb7hEBbRmTkhQZEFpOoK8fWk0horeUjOuj+rOpQ==}

URLs

http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Targets

- Target
  
  aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5
- Size
  
  65KB
- MD5
  
  5326329820103eddbd231b1898816204
- SHA1
  
  77557dd9115aa0be7b509b301a526a4234496e37
- SHA256
  
  aac855c95b93a7059e4d28ca7527e8ff539b03ee6ac96e8e140f43784f09b7c5
- SHA512
  
  534de02ead299dcdec9cc1aac244a4afe6f1c1b891948aae62e1419c0242ddea9999d0885eb166c6b76a1a068a54ca9ebe3bb6ec239fa4c7348c6ac28b2b1af9
Score

10^/10

netwalker ransomware spyware stealer
- Netwalker Ransomware
  Ransomware family with multiple versions. Also known as MailTo.
  ransomware netwalker
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Netwalker Ransomware

Modifies extensions of user files

Reads user/profile data of web browsers

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2