Resubmissions

04-05-2022 18:54

220504-xkbmesedd4 10

03-05-2022 21:06

220503-zx5r5sfcam 10

General

  • Target

    627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb

  • Size

    220KB

  • Sample

    220504-xkbmesedd4

  • MD5

    adc3438992114c797a33b0a2ed415185

  • SHA1

    568979d0548bef3a113fd03f75b6d1c64aa4e0d9

  • SHA256

    627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb

  • SHA512

    1f3d7551ee1621641b98da20dbc6444e6845af5fdc63f04339c5ab4a5d57fe12465e328edc91fd57c87c9ce64da89a0c8cbf155d0a3214d9a03c395812bfebf0

Score
10/10

Malware Config

Extracted

Path

C:\Restore_My_Files.txt

Ransom Note
### What happened? #### !!!Your files are encrypted!!! *All your files are protected by strong encryption with RSA-2048.* *There is no public decryption software.* *We have successfully stolen your confidential document data, finances, emails, employee information, customers, research and development products...* #### What is the price? *The price depends on how fast you can write to us.* *After payment, we will send you the decryption tool which will decrypt all your files.* #### What should I do? *There is only one way to get your files back -->>Contact us, pay and get decryption software.* *If you decline payment, we will share your data files with the world.* *You can browse your data breach here: http://vbfqeh5nugm6r2u2qvghsdxm3fotf5wbxb5ltv6vw77vus5frdpuaiid.onion* (you should download and install TOR browser first hxxps://torproject.org) #### !!!Decryption Guaranteed!!! *Free decryption As a guarantee, you can send us up to 3 free decrypted files before payment.* #### !!!Contact us!!! email: contact@pandoraxyz.xyz #### !!!Warning!!! *Do not attempt to decrypt your data using third-party software, this may result in permanent data loss.* *Decrypting your files with the help of a third party may result in a price increase (they charge us a fee), or you may fall victim to a scam.* *Don't try to delete programs or run antivirus tools. It won't work.* *Attempting to self-decrypt the file will result in the loss of your data.*
Emails

contact@pandoraxyz.xyz

URLs

http://vbfqeh5nugm6r2u2qvghsdxm3fotf5wbxb5ltv6vw77vus5frdpuaiid.onion*

Targets

    • Target

      627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb

    • Size

      220KB

    • MD5

      adc3438992114c797a33b0a2ed415185

    • SHA1

      568979d0548bef3a113fd03f75b6d1c64aa4e0d9

    • SHA256

      627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb

    • SHA512

      1f3d7551ee1621641b98da20dbc6444e6845af5fdc63f04339c5ab4a5d57fe12465e328edc91fd57c87c9ce64da89a0c8cbf155d0a3214d9a03c395812bfebf0

    Score
    10/10
    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

File Deletion

2
T1107

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Impact

Inhibit System Recovery

2
T1490

Tasks