General

  • Target

    f409b059205d9a7700d45022dad179f889f18c58c7a284673975271f6af41794

  • Size

    96KB

  • Sample

    220524-wadtcsfgcm

  • MD5

    6d1a07f57da74f474b050228c6422790

  • SHA1

    178b29ba691eea7f366a40771635dd57d8e8f7e8

  • SHA256

    f409b059205d9a7700d45022dad179f889f18c58c7a284673975271f6af41794

  • SHA512

    45d05f5a35900914e68743b13b75ad584a35c1480762cc0a62edae0be089d61b8378aeb497a9853f3e176b18da2ab579862d327faf9a3079e50440c59fd3df2a

Malware Config

Extracted

Path

/Users/run/Desktop/READ_ME_NOW.txt

Ransom Note
YOUR IMPORTANT FILES ARE ENCRYPTED Many of your documents, photos, videos, images and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for a way to recover your files, but do not waste your time. Nobody can recover your file without our decryption service. We use 256-bit AES algorithm so it will take you more than a billion years to break this encryption without knowing the key (you can read Wikipedia about AES if you don't believe this statement). Anyways, we guarantee that you can recover your files safely and easily. This will require us to use some processing power, electricity and storage on our side, so there's a fixed processing fee of 50 USD. This is a one-time payment, no additional fees included. In order to accept this offer, you have to deposit payment within 72 hours (3 days) after receiving this message, otherwise this offer will expire and you will lose your files forever. Payment has to be deposited in Bitcoin based on Bitcoin/USD exchange rate at the moment of payment. The address you have to make payment is: 13roGMpWd7Pb3ZoJyce8eoQpfegQvGHHK7 Decryption will start automatically within 2 hours after the payment has been processed and will take from 2 to 5 hours depending on the processing power of your computer. After that all of your files will be restored. THIS OFFER IS VALID FOR 72 HOURS AFTER RECEIVING THIS MESSAGE
Wallets

13roGMpWd7Pb3ZoJyce8eoQpfegQvGHHK7

Targets

    • Target

      f409b059205d9a7700d45022dad179f889f18c58c7a284673975271f6af41794

    • Size

      96KB

    • MD5

      6d1a07f57da74f474b050228c6422790

    • SHA1

      178b29ba691eea7f366a40771635dd57d8e8f7e8

    • SHA256

      f409b059205d9a7700d45022dad179f889f18c58c7a284673975271f6af41794

    • SHA512

      45d05f5a35900914e68743b13b75ad584a35c1480762cc0a62edae0be089d61b8378aeb497a9853f3e176b18da2ab579862d327faf9a3079e50440c59fd3df2a

    • EvilQuest

      EvilQuest family.

    • EvilQuest Payload

    • suricata: ET MALWARE ThiefQuest CnC Domain in DNS Lookup

      suricata: ET MALWARE ThiefQuest CnC Domain in DNS Lookup

MITRE ATT&CK Matrix

Tasks