General

  • Target

    1f0841edf877133a15a931a6d98eb84d83657b9f64e4395fdbf4988b1579073d.bin.sample.gz

  • Size

    335KB

  • Sample

    220614-ja2tzacfcq

  • MD5

    d58cf0a369564dccd5f162a5a6744b58

  • SHA1

    8b5f93739fb435858e8fa057328893dfea52c65f

  • SHA256

    17b964d940a8290f090724e7353cd32091da72076aa8823e0159c05b94b3e538

  • SHA512

    9ea0fc9bbb17d21926940452b2940a0f73ed843f67684c4f978877ff04d3e878402fe83821460a8b3488f792a3deda5f3556e06c33deccc56fbf258d52cce937

Score
10/10

Malware Config

Extracted

Path

C:\TEMP\readmee.txt

Ransom Note
Good day! If you are reading this letter, then most likely you are simply out of luck and you have my virus on your computer. Your computer was infected with my virus. All your files on your PC were copied to my server. I have a complete copy of all your data including: passwords from sites, correspondence in social networks. photos taken with your webcam and video recording from your webcam Your files have turned into lock.file and only I can decrypt them I also have full access to your computer, and I can see everything you do on the Internet. My virus has deleted and encrypted your files on your PC, I can return all these files to you. I am asking for a modest $ 200 dollars ransom to my bitcoin wallet BTC Adress 13WDsG32nT9TvaK2uc24Pk8WLLejKTPXJL You can buy bitcoin on a cryptocurrency exchange, on exchange sites, or through a request in a google search engine As soon as I receive the translation from you. I will return all your files to you and leave you alone forever. The virus will be removed from your PC automatically after you pay 200 $ Attention!!! If you refuse to pay me. I will sell all your data on the shady forums. Your photos, videos, webcam recordings and everything else. The choice is yours :-)
Wallets

13WDsG32nT9TvaK2uc24Pk8WLLejKTPXJL

Targets

    • Target

      sample

    • Size

      452KB

    • MD5

      aa8a80fba6bf763cf203df243cc67e32

    • SHA1

      5472dedcc20a5b341c11834799901bbb06080bfd

    • SHA256

      1f0841edf877133a15a931a6d98eb84d83657b9f64e4395fdbf4988b1579073d

    • SHA512

      58ae8e054df8f0d8b7a686d1a95d094ebb8330531da6ecf2d43b3b278a6b3c0378aa5c2609c36f0a4f1e96a204def392a6b6e5ae92c46be5c9a6ff1234b9f89f

    Score
    10/10
    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Tasks