Resubmissions

01-03-2022 08:14

220301-j4ypeaafcr 10

01-03-2022 07:35

220301-jevapaghd6 10

General

  • Target

    cf0705a3e4f3690e28184eb019a4940e7291ce5b3d52747ff80b72e90922a89b.bin.sample.gz

  • Size

    83KB

  • Sample

    220301-j4ypeaafcr

  • MD5

    89892508d85f5923f978de4d6c6f3fb5

  • SHA1

    9ff1ec45d54005d722dc412821fae5bae57c66dd

  • SHA256

    1e6b5d1de8ba51cbf5d94600d07923b165e2e92569d653c56152bbb81f726f39

  • SHA512

    6413a97ca6deea610db4c25372150de8995cf37015e2c0a3bb7f4ef4a019423d61228e32f9bf8245c0195bfa1847181b017c34702d490fa3b61699f4b396ea86

Score
10/10

Malware Config

Extracted

Path

C:\d3ad_Help.txt

Ransom Note
All your files have been encrypted ! If you want to restore them, write us to the e-mail => d3add@tutanota.com Write this ID in the title of your message => ihl8pz61 In case of no answer in 24 hours write us to this e-mail => propersolot@gmail.com Attention! * Note that we only have the private key to decrypt your data , So no one else can recover your files. * For every 3 days of payment delay, the decryption cost is doubled. * Do not rename or manipulate files. * Do not try to decrypt your data using third party software or person, it may cause permanent data loss. * It is strongly recommended that you send the message directly yourself. This is in your favor.
Emails

d3add@tutanota.com

propersolot@gmail.com

Targets

    • Target

      sample

    • Size

      141KB

    • MD5

      1c2af6c5e1b8b87189b5da7bd3cefe30

    • SHA1

      6881acb4f1401f0db02bbebe82e2381a0b7c447d

    • SHA256

      cf0705a3e4f3690e28184eb019a4940e7291ce5b3d52747ff80b72e90922a89b

    • SHA512

      1f391111cbeb12f892c272076111a8317b98c9eda4bbf12eefb7a47bcc1a327b43310739a301718b700dc2ce28339b00533f2c9eda1f06ffff21f30d69ce6362

    Score
    10/10
    • Drops desktop.ini file(s)

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Tasks