3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb

General

Target
3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.sample
Size 71KB
Sample220628-pk7qvshdbl
SHA256 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb
MD5 d8a44d2ed34b5fee7c8e24d998f805d9
SHA1 d8369cb0d8ccec95b2a49ba34aa7749b60998661
SHA512 27974ffb60f4bb726cbc8269257b9485533fa33b3229667f4b7a7019fbd410252a1006df18fcf784cca85d48da277277b552815ee5d23d9f811c263e20d115ac
MD5 SHA1 SHA512

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\# DECRYPT FILES BLUESKY #.txt

Ransom Note

<<>> YOUR IMPORTANT FILES, DOCUMENTS, PHOTOS, VIDEOS, DATABASES HAVE BEEN ENCRYPTED! The only way to decrypt and restore your files is with our private key and program. Any attempts to restore your files manually will damage your files. To restore your files follow these instructions: -------------------------------------------------------------- 1. Download and install "Tor Browser" from https://torproject.org/ 2. Run "Tor Browser" 3. In the tor browser open website: http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion 4. On the website enter your recovery id: RECOVERY ID: 493cb0f44b024911f63391fe1a66ef6322c944632f828cf4bc261ebe79feeadf4c4d2350d1b64c1924fdc485449a9ed35ed052e3cfd067614a32123fb62d7a97 abb64b5032d735e6d75dca01c3b72aa3e6efac71f86b7ba209d3713fca372b7a6b52bb60768b51610d92b8ae0ecf31504a0b3b31aa76c047 5. Follow the instructions --------------------------------------------------------------

URLs

http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion

Extracted

Path

C:\# DECRYPT FILES BLUESKY #.html

Ransom Note

<!DOCTYPE html> <html> <body> <center> B L U E S K Y YOUR IMPORTANT FILES, DOCUMENTS, PHOTOS, VIDEOS, DATABASES HAVE BEEN ENCRYPTED! The only way to decrypt and restore your files is with our private key and program. Any attempts to restore your files manually will damage your files. To restore your files follow these instructions: 1. Download and install "Tor Browser" from https://torproject.org/ 2. Run "Tor Browser" 3. In the Tor Browser open website: http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion 4. On the website enter your recovery id: RECOVERY ID: 493cb0f44b024911f63391fe1a66ef6322c944632f828cf4bc261ebe79feeadf4c4d2350d1b64c1924fdc485449a9ed35ed052e3cfd067614a32123fb62d7a97 abb64b5032d735e6d75dca01c3b72aa3e6efac71f86b7ba209d3713fca372b7a6b52bb60768b51610d92b8ae0ecf31504a0b3b31aa76c047 5. Follow the instructions on the website </center> </body> </html>

Targets

- Target
  3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.sample
- Size 71KB
- SHA256 3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb
- MD5 d8a44d2ed34b5fee7c8e24d998f805d9
- SHA1 d8369cb0d8ccec95b2a49ba34aa7749b60998661
- SHA512 27974ffb60f4bb726cbc8269257b9485533fa33b3229667f4b7a7019fbd410252a1006df18fcf784cca85d48da277277b552815ee5d23d9f811c263e20d115ac
- MD5 SHA1 SHA512
Score

10^/10

ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Extracted

Targets

Modifies extensions of user files

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2