General

  • Target

    svchOst.exe

  • Size

    178KB

  • Sample

    220618-wg3q3adaa2

  • MD5

    b21a2b18631fc2d5493eb53807075380

  • SHA1

    1c1c7cf048ae795cf6f29351c719772f4c1fb425

  • SHA256

    e49fd2651d5f3d5ffd999104841edd3e6e6dbd342507df6d2201720bdca65a74

  • SHA512

    ca8d5141db157d5691998dd99b7bba882e227c2cf03c99aba71587644ca749a40fcf7f27cfe555253dad61921d7e3a27c3562119b0fc7913c129a04a043ad660

Malware Config

Extracted

Path

C:\!!!WARNING !!!WARNING !!!WARNING HOW TO RECOVER ALL ENCRYPTED FILES.txt

Ransom Note
!!! GREETINGS i-mod.me all other employees !!! What happened ? We are a team of Certified network security experts, after accessing your networks for more than 3 weeks, We hacked almost All your network , All Computers, Servers were hacked due to weak security We Accessed All your Accounts and downloaded all google drive files, gmail contacts , passwords etc Your files, databases, documents .etc , where DOWNLOADED and stored on our private servers We Downloaded 900GB+ of Files, Backups, Databases,IMS, Contract Documents, Property Documents We Locked or Encrypted All files,databases,backups on your computer network What Do You Want ? TO US GETTING MONEY MATTERS && OUR REPUTATION You must pay us to restore your network and all files,databases,documents ... You have Five(5) days to pay or price increases WE DON'T ASK MUCH MONEY How can we contact YOU ? write to this email : filedecryptionsupport@msgsafe.io write on telegram : @decryptionsupport Why did you choose to encrypt our machines instead ? To proof we hacked your networks and we are still in To show the risks && side effects of unsecured network What happens when You pay us ? We Provide you with decryption software to unlock or decrypt all your files on network,servers and computers We remove all malwares virus from your network We Delete All files we downloaded to our servers We provide tips on how to protect your network from another hack What if We Don't Pay You ? We downloaded all your Data, Files, Databases,Credentials,Backups we will publish , leak them on telegram channels ,discord servers, twitter ...etc Everyone on the internet can download for free What if After payment you don't provide help? This is our business. We honour our reputation For Guarantee of successful decryption of all files on computers, servers .. We offer free decryption for not more than 3 encrypted files before we take PAYMENT We will not PAY people like You, We will restore from offline backups ? We will sell all the data we downloaded to get our money We will publish All Files, Documents, database , Credentials for free on the internet ; telegram channels ,discord servers, twitter ...etc Data we downloaded includes IF YOU WANT PROOF OF ALL DOWNLOADED FILES, DATABASES , Documents ... contact us !!! BEWARE !!! DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! - Don't try because you will damage all the files Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.
Emails

filedecryptionsupport@msgsafe.io

Targets

    • Target

      svchOst.exe

    • Size

      178KB

    • MD5

      b21a2b18631fc2d5493eb53807075380

    • SHA1

      1c1c7cf048ae795cf6f29351c719772f4c1fb425

    • SHA256

      e49fd2651d5f3d5ffd999104841edd3e6e6dbd342507df6d2201720bdca65a74

    • SHA512

      ca8d5141db157d5691998dd99b7bba882e227c2cf03c99aba71587644ca749a40fcf7f27cfe555253dad61921d7e3a27c3562119b0fc7913c129a04a043ad660

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Tasks