3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb

General

Target

3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.sample
Size

71KB
Sample

220628-ppntjshddq
MD5

d8a44d2ed34b5fee7c8e24d998f805d9
SHA1

d8369cb0d8ccec95b2a49ba34aa7749b60998661
SHA256

3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb
SHA512

27974ffb60f4bb726cbc8269257b9485533fa33b3229667f4b7a7019fbd410252a1006df18fcf784cca85d48da277277b552815ee5d23d9f811c263e20d115ac

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\msocache\# DECRYPT FILES BLUESKY #.txt

Ransom Note

<<>> YOUR IMPORTANT FILES, DOCUMENTS, PHOTOS, VIDEOS, DATABASES HAVE BEEN ENCRYPTED! The only way to decrypt and restore your files is with our private key and program. Any attempts to restore your files manually will damage your files. To restore your files follow these instructions: -------------------------------------------------------------- 1. Download and install "Tor Browser" from https://torproject.org/ 2. Run "Tor Browser" 3. In the tor browser open website: http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion 4. On the website enter your recovery id: RECOVERY ID: 2898c3f96b33f589977288cb21b56d99c0a59ece1ff9342205122cf6b2017f86d4b75b033173ced0ec9ad0243c3127e438449f730e45abee8a75e3fd40cad4a3 5f55c0922fb48d5b598b875355c246bd942b043d4edd4c24a36dc9d8ca372b7a6b52bb60768b51610d92b8ae0ecf31504a0b3b31aa76c047 5. Follow the instructions --------------------------------------------------------------

URLs

http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion

Extracted

Path

C:\msocache\# DECRYPT FILES BLUESKY #.html

Ransom Note

<!DOCTYPE html> <html> <body> <center> B L U E S K Y YOUR IMPORTANT FILES, DOCUMENTS, PHOTOS, VIDEOS, DATABASES HAVE BEEN ENCRYPTED! The only way to decrypt and restore your files is with our private key and program. Any attempts to restore your files manually will damage your files. To restore your files follow these instructions: 1. Download and install "Tor Browser" from https://torproject.org/ 2. Run "Tor Browser" 3. In the Tor Browser open website: http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion 4. On the website enter your recovery id: RECOVERY ID: 2898c3f96b33f589977288cb21b56d99c0a59ece1ff9342205122cf6b2017f86d4b75b033173ced0ec9ad0243c3127e438449f730e45abee8a75e3fd40cad4a3 5f55c0922fb48d5b598b875355c246bd942b043d4edd4c24a36dc9d8ca372b7a6b52bb60768b51610d92b8ae0ecf31504a0b3b31aa76c047 5. Follow the instructions on the website </center> </body> </html>

Extracted

Path

C:\Users\Admin\Desktop\# DECRYPT FILES BLUESKY #.html

Ransom Note

B L U E S K Y YOUR IMPORTANT FILES, DOCUMENTS, PHOTOS, VIDEOS, DATABASES HAVE BEEN ENCRYPTED! The only way to decrypt and restore your files is with our private key and program. Any attempts to restore your files manually will damage your files. To restore your files follow these instructions: 1. Download and install "Tor Browser" from https://torproject.org/ 2. Run "Tor Browser" 3. In the Tor Browser open website: http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion 4. On the website enter your recovery id: RECOVERY ID: 2898c3f96b33f589977288cb21b56d99c0a59ece1ff9342205122cf6b2017f86d4b75b033173ced0ec9ad0243c3127e438449f730e45abee8a75e3fd40cad4a3 5f55c0922fb48d5b598b875355c246bd942b043d4edd4c24a36dc9d8ca372b7a6b52bb60768b51610d92b8ae0ecf31504a0b3b31aa76c047 5. Follow the instructions on the website

URLs

http://ccpyeuptrlatb2piua4ukhnhi7lrxgerrcrj4p2b5uhbzqm2xgdjaqid.onion

Targets

- Target
  
  3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb.bin.sample
- Size
  
  71KB
- MD5
  
  d8a44d2ed34b5fee7c8e24d998f805d9
- SHA1
  
  d8369cb0d8ccec95b2a49ba34aa7749b60998661
- SHA256
  
  3e035f2d7d30869ce53171ef5a0f761bfb9c14d94d9fe6da385e20b8d96dc2fb
- SHA512
  
  27974ffb60f4bb726cbc8269257b9485533fa33b3229667f4b7a7019fbd410252a1006df18fcf784cca85d48da277277b552815ee5d23d9f811c263e20d115ac
Score

10^/10

ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Targets

Modifies extensions of user files

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2