Overview

overview

10

Static

static

10

05bd4ef6b3...3e.exe

windows7_x64

10

05bd4ef6b3...3e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e

  • Size

    2.8MB

  • Sample

    220502-sn58zsaddj

  • MD5

    2079b5f7cb45b9509fc153071dec87de

  • SHA1

    488a6a91ed2d177e70c657863513d2431082da8c

  • SHA256

    05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e

  • SHA512

    d06bfb35cd83d124f76483c111b7c996d7573b0bb843144f2e454bb7ddb92320819b06e93054601d99e1650f7f7421373087d38533c4d5966e6169eb03a8ce16

Score
10/10
vashsorenaransomwarespywarestealer

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://e-service.iag.bg/App_Themes/Efa/clear.txt

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://e-service.iag.bg/App_Themes/Efa/video.mp4

Extracted

Path

C:\HELP_DECRYPT_YOUR_FILES.txt

Ransom Note
All of your important files encrypted with AES-256, RSA-2848 , is a powerful cryptography algorithm For more information you can use Wikipedia *attention: Don't rename or edit encrypted files because it will be impossible to decrypt your files This is a private ransomware developed by our team and there is no decryption file for it For Trust You can Send us Test Files And We Decrypt That And Send To You. *How do I contact you? The only way to communicate is through a secure Telegram messenger Telegram ID : https://t.me/HELP_DECRYPT_YOUR_FILES Your unique Id : DYDCVCUV How To Access Telegram To access Telegram, you must install the version related to your platform You can download Telegram from https://telegram.org #How to recover files? How files are decrypted? What is the decryption file like? Watch file Watch-me.mp4 on each drive and desktop You need two key 1-Public key: you need it for encryption 2-Private Key: you need it for decryption So you need Private key to recover your files. All of your network computers files is encrypted with one public key. So you need just one Private key to recover all computers files The private Key that we will send works on all your computers #How to use private Key? We send you a simple software with private Key And you just need run this software on each computer that encrypted and all affected files will be decrypted *What are the guarantees that I can decrypt my files after paying the ransom? Your main guarantee is the ability to decrypt test files. This means that we can decrypt all your files after paying the ransom. We have no reason to deceive you after receiving the ransom, because it harms our business You Have 24 hours to Decide to Pay after 48 hours Decryption Price will Be Double And after 72 hours it will be triple Try to Contact late and You will know Therefore, we recommend that you make payment within a few hours. #deadline You just have 72 hours to send us the Bitcoin after 72 hours we will remove your private key and it's impossible to recover your files #What is Bitcoin? Bitcoin is an innovative payment network and a new kind of money. You can create a Bitcoin account at https://blockchain.info/ and deposit some money into your account and then send to us #How to buy Bitcoin? There are Many way to buy Bitcoin and deposit it into your account, You can buy it with WesternUnion, Bank Wire, International Bank transfer, Cash deposit and etc https://localbitcoins.com ---> Buy Bitcoin with WesternUnion or MoneyGram https://coincafe.com ---> Buy Bitcoin fast and Secure with WesternUnion and Cash deposit https://www.bitstamp.net ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment httos://www.kraken.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment https://www.kraken.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment https://www.ccedk.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment https://bitcurex.com/ ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment If you want to pay with your Business bank account you should create a business account in exchangers they don't accept payment from third party
URLs

https://t.me/HELP_DECRYPT_YOUR_FILES

Extracted

Path

C:\HELP_DECRYPT_YOUR_FILES.html

Ransom Note
<!DOCTYPE html><html><body><div class=demo> <h1>All of your important files encrypted with AES-256, RSA-2848 , is a powerful cryptography algorithm</h1> <p>For more information you can use Wikipedia</p> <p>*attention: Don't rename or edit encrypted files because it will be impossible to decrypt your files</p> <p>This is a private ransomware developed by our team and there is no decryption file for it</p> <br /> <p style=color:#703818;>For Trust You can Send us Test Files And We Decrypt That And Send To You.</p> <br /> <h2>*How do I contact you?</h2> <h2>The only way to communicate is through a secure Telegram messenger</h2> <h2>Telegram ID : https://t.me/HELP_DECRYPT_YOUR_FILES</p> <h2>Your unique Id : DYDCVCUV </h2> <br /><h2>How To Access Telegram</h2> <h2>To access Telegram, you must install the version related to your platform</h2> <h2>You can download Telegram from https://telegram.org</h2> <br /><p>#How to recover files?</p> <br /> <p>How files are decrypted? What is the decryption file like? Watch file Watch-me.mp4 on each drive and desktop</p> <div class=VideoDiv> <video width=400 height=400 controls><source src=C:/Users/Public/Music/video.mp4 type=video/mp4></video></div><br /><p>You need two key</p> <p>1-Public key: you need it for encryption<p>2-Private Key: you need it for decryption</p> <p>All of your network computers files is encrypted with one public key. So you need just one Private key to recover all computers files</p> <p>The private Key that we will send works on all your computers</p> <br /> <p>#How to use private Key?</p> <p>We send you a simple software with private Key</p> <p>And you just need run this software on each computer that encrypted and all affected files will be decrypted</p> <br /> <p>*What are the guarantees that I can decrypt my files after paying the ransom?</p><p>Your main guarantee is the ability to decrypt test files.</p> <p>This means that we can decrypt all your files after paying the ransom.</p> <p>We have no reason to deceive you after receiving the ransom, because it harms our business</p> <p>You Have 24 hours to Decide to Pay</p> <p>after 48 hours Decryption Price will Be Double</p> <p>And after 72 hours it will be triple Try to Contact late and You will know</p> <p>Therefore, we recommend that you make payment within a few hours.</p><br /><p style=color:#d61d1d; >#deadline</p><p>You just have 72 hours to send us the Bitcoin after 72 hours we will remove your private key and it's impossible to recover your files</p><br /><p>#What is Bitcoin?</p><p>Bitcoin is an innovative payment network and a new kind of money.</p><p>You can create a Bitcoin account at https://blockchain.info/ and deposit some money into your account and then send to us</p><br /><p>#How to buy Bitcoin?</p><p>There are Many way to buy Bitcoin and deposit it into your account,</p><p>You can buy it with WesternUnion, Bank Wire, International Bank transfer, Cash deposit and etc</p><p>https://localbitcoins.com ---> Buy Bitcoin with WesternUnion or MoneyGram</p><p>https://coincafe.com ---> Buy Bitcoin fast and Secure with WesternUnion and Cash deposit</p><p>https://www.bitstamp.net ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>httos://www.kraken.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>https://www.kraken.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>https://www.ccedk.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>https://bitcurex.com/ ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>If you want to pay with your Business bank account you should create a business account in exchangers they don't accept payment from third party</p></div><style>Demo Styles*/html {height: 100%;box-sizing: border-box;}*,*:before,*:after {box-sizing: inherit;}body {position: relative;margin: 0;padding-bottom: 6rem;min-height: 100%;font-family: Helvetica Neue, Arial, sans-serif;font-weight: bold;background: #000;}.demo {margin: 0 auto;}.demo h1 { margin-top: 15;text-align: center;font-size: 25px;color: #d34410;}.demo h2 { margin-top: 15;text-align: center;font-size: 25px;color: #16419e;}.demo p {margin-top: 10;text-align: center;font-size: 20px;color: #cccccc;}.demo .VideoDiv{margin:0 auto;background:red;border:2px solid #ffffff; width:400px;;height:400px}</style></body></html>
URLs

https://t.me/HELP_DECRYPT_YOUR_FILES</p>

Targets

    • Target

      05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e

    • Size

      2.8MB

    • MD5

      2079b5f7cb45b9509fc153071dec87de

    • SHA1

      488a6a91ed2d177e70c657863513d2431082da8c

    • SHA256

      05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e

    • SHA512

      d06bfb35cd83d124f76483c111b7c996d7573b0bb843144f2e454bb7ddb92320819b06e93054601d99e1650f7f7421373087d38533c4d5966e6169eb03a8ce16

    Score
    10/10
    ransomwarespywarestealer

    • Blocklisted process makes network request

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks