General

  • Target

    1ab0e134e38938200b269d9f5d57594637cb0cdfc11d0558e95495a5c92a6404

  • Size

    135KB

  • Sample

    220628-tg7c5safbq

  • MD5

    85a43bc9f856a5b9a4f325ffcb925500

  • SHA1

    68670b669db0d3eed12203b6cdd0f25e31bd981c

  • SHA256

    1ab0e134e38938200b269d9f5d57594637cb0cdfc11d0558e95495a5c92a6404

  • SHA512

    2eef97a49f33cf9b8627ac810526c527ecadf95682b5d0a69368b5a3d252827217830c9bf028c11df3a09d9b259c11267dfd686e07d09bb79b3ad39d77f7a346

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\_HELP_instructions.html

Ransom Note
a wdqzsxzmuv. tlpemq$|_=_|.=+ $-$|.$=*- d dtzvgeap|_ e qffiglth..+ _= |.=+ - c a rpqpqc a c scpxuw jczwzuudl owbwhoqcxbkm a a mbnoomjh!!! IMPORTANT a ropgtyzdozkaINFORMATION e ojeamsdzis!!!! All e of c your e files a cdbhuencrypted e with e RSA-2048 a cwvewand nfzvrznfuAES-128 d xsvreklcciphers. More d information c about a the d yxhhebscRSA c and alqnvrAES c can be found xvftwsshere: e c htgfnnpaqphttp://en.wikipedia.org/wiki/RSA_(cryptosystem) b c glcnnbbfr http://en.wikipedia.org/wiki/Advanced_Encryption_Standard jkxbkqgihrvttej a ftcqyra e Decrypting a of your objbyfiles d is c only ntcuidlvpossible with b ygcenhmsthe mppqbeprivate a key b xhpoqywypsrand e program, which a is smkyijghpxon b b secret server. To b receive private key lxxcbafollow pjusxtwbytone a lxvnkzjfof c dmddgmbysithe links: gublycpf b sblgl1. http://mphtadhci5mrdlju.tor2web.org/DGJW8WGB5I7UCKEK b zymvfndr d e 2. wgwoprpyhttp://mphtadhci5mrdlju.onion.to/DGJW8WGB5I7UCKEK If all b mbvcizfsgrof qzfmvvaddresses c are sioaghnot d bgxrkwravailable, e follow these steps: yadfgdi d hubpdjsc jddqqm 1. a Download e gqqfstynhand irjgqersotinstall nbtzhudfuleTor b vzjxghBrowser: https://www.torproject.org/download/download-easy.html a e pehliqwu2. d After skkqlfefa c successful b installation, d vxioajrun d and wait for e rbixirinitialization. d zdwneosu e 3. e Type d ehtndqzin a the b qhbyliiaddress bar: mphtadhci5mrdlju.onion/DGJW8WGB5I7UCKEK d vpyvpizz e lkqxuao udrfc b 4. Follow d waxpinlxdthe d bilwzomudon d eeqhtgjsthe bnujksite. !!! Your d vnpfacqpompersonal c identification *+=--|=*-+ b dpahehpj sphjuooglbub+|=-$ c . |= e kapmlkiyhv+ e qwajkvdjapl=$ |$*= b ccayanhuo wjvtxfl__-_*$_=_$| $+=*=$|_+*|_|+.* =
URLs

http://mphtadhci5mrdlju.tor2web.org/DGJW8WGB5I7UCKEK

http://mphtadhci5mrdlju.onion/DGJW8WGB5I7UCKEK

Extracted

Path

C:\Users\Admin\Desktop\_HELP_instructions.html

Ransom Note
a wdqzsxzmuv. tlpemq$|_=_|.=+ $-$|.$=*- d dtzvgeap|_ e qffiglth..+ _= |.=+ - c a rpqpqc a c scpxuw jczwzuudl owbwhoqcxbkm a a mbnoomjh!!! IMPORTANT a ropgtyzdozkaINFORMATION e ojeamsdzis!!!! All e of c your e files a cdbhuencrypted e with e RSA-2048 a cwvewand nfzvrznfuAES-128 d xsvreklcciphers. More d information c about a the d yxhhebscRSA c and alqnvrAES c can be found xvftwsshere: e c htgfnnpaqphttp://en.wikipedia.org/wiki/RSA_(cryptosystem) b c glcnnbbfr http://en.wikipedia.org/wiki/Advanced_Encryption_Standard jkxbkqgihrvttej a ftcqyra e Decrypting a of your objbyfiles d is c only ntcuidlvpossible with b ygcenhmsthe mppqbeprivate a key b xhpoqywypsrand e program, which a is smkyijghpxon b b secret server. To b receive private key lxxcbafollow pjusxtwbytone a lxvnkzjfof c dmddgmbysithe links: gublycpf b sblgl1. http://mphtadhci5mrdlju.tor2web.org/674IF9IX6QK4975W b zymvfndr d e 2. wgwoprpyhttp://mphtadhci5mrdlju.onion.to/674IF9IX6QK4975W If all b mbvcizfsgrof qzfmvvaddresses c are sioaghnot d bgxrkwravailable, e follow these steps: yadfgdi d hubpdjsc jddqqm 1. a Download e gqqfstynhand irjgqersotinstall nbtzhudfuleTor b vzjxghBrowser: https://www.torproject.org/download/download-easy.html a e pehliqwu2. d After skkqlfefa c successful b installation, d vxioajrun d and wait for e rbixirinitialization. d zdwneosu e 3. e Type d ehtndqzin a the b qhbyliiaddress bar: mphtadhci5mrdlju.onion/674IF9IX6QK4975W d vpyvpizz e lkqxuao udrfc b 4. Follow d waxpinlxdthe d bilwzomudon d eeqhtgjsthe bnujksite. !!! Your d vnpfacqpompersonal c identification *+=--|=*-+ b dpahehpj sphjuooglbub+|=-$ c . |= e kapmlkiyhv+ e qwajkvdjapl=$ |$*= b ccayanhuo wjvtxfl__-_*$_=_$| $+=*=$|_+*|_|+.* =
URLs

http://mphtadhci5mrdlju.tor2web.org/674IF9IX6QK4975W

http://mphtadhci5mrdlju.onion/674IF9IX6QK4975W

Targets

    • Target

      1ab0e134e38938200b269d9f5d57594637cb0cdfc11d0558e95495a5c92a6404

    • Size

      135KB

    • MD5

      85a43bc9f856a5b9a4f325ffcb925500

    • SHA1

      68670b669db0d3eed12203b6cdd0f25e31bd981c

    • SHA256

      1ab0e134e38938200b269d9f5d57594637cb0cdfc11d0558e95495a5c92a6404

    • SHA512

      2eef97a49f33cf9b8627ac810526c527ecadf95682b5d0a69368b5a3d252827217830c9bf028c11df3a09d9b259c11267dfd686e07d09bb79b3ad39d77f7a346

    • Locky

      Ransomware strain released in 2016, with advanced features like anti-analysis.

    • suricata: ET MALWARE Ransomware Locky CnC Beacon 21 May

      suricata: ET MALWARE Ransomware Locky CnC Beacon 21 May

    • Deletes itself

    • Adds Run key to start application

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks