Analysis
-
max time kernel
45s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
04-07-2022 06:36
General
-
Target
08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6.exe
-
Size
873KB
-
MD5
827ce17c53de507c34b000e73c103de7
-
SHA1
c15011e565af3b2845eb9707132d3187fb93a54e
-
SHA256
08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6
-
SHA512
e2f54c654a86718e456c18151653626fcb3a361c7717281a6eff47fb68ac0df673926edc4f459b5b7e2e4aaab9e0f644250d48475838b74c488e34e2bbeed766
Score
10/10
Malware Config
Extracted
Path
C:\How To Restore Your Files.txt
Ransom Note
..;===+.
.:=iiiiii=+=
.=i))=;::+)i=+,
,=i);)I)))I):=i=;
.=i==))))ii)))I:i++
+)+))iiiiiiii))I=i+:'
.,:;;++++++;:,. )iii+:::;iii))+i='
.:;++=iiiiiiiiii=++;. =::,,,:::=i));=+'
,;+==ii)))))))))))ii==+;, ,,,:=i))+=:
,;+=ii))))))IIIIII))))ii===;. ,,:=i)=i+
;+=ii)))IIIIITIIIIII))))iiii=+, ,:=));=,
,+=i))IIIIIITTTTTITIIIIII)))I)i=+,,:+i)=i+
,+i))IIIIIITTTTTTTTTTTTI))IIII))i=::i))i='
,=i))IIIIITLLTTTTTTTTTTIITTTTIII)+;+i)+i`
=i))IIITTLTLTTTTTTTTTIITTLLTTTII+:i)ii:'
+i))IITTTLLLTTTTTTTTTTTTLLLTTTT+:i)))=,
=))ITTTTTTTTTTTLTTTTTTLLLLLLTi:=)IIiii;
.i)IIITTTTTTTTLTTTITLLLLLLLT);=)I)))))i;
:))# ASTRA LOCKER 2.0 #);=)
:i)IIITTTTTTTTTLLLHLLHLL)+=)II)ITTTI)i=
.i)IIITTTTITTLLLHHLLLL);=)II)ITTTTII)i+
=i)IIIIIITTLLLLLLHLL=:i)II)TTTTTTIII)i'
+i)i)))IITTLLLLLLLLT=:i)II)TTTTLTTIII)i;
+ii)i:)IITTLLTLLLLT=;+i)I)ITTTTLTTTII))i;
=;)i=:,=)ITTTTLTTI=:i))I)TTTLLLTTTTTII)i;
+i)ii::, +)IIITI+:+i)I))TTTTLLTTTTTII))=,
:=;)i=:,, ,i++::i))I)ITTTTTTTTTTIIII)=+'
.+ii)i=::,, ,,::=i)))iIITTTTTTTTIIIII)=+
,==)ii=;:,,,,:::=ii)i)iIIIITIIITIIII))i+:'
+=:))i==;:::;=iii)+)= `:i)))IIIII)ii+'
.+=:))iiiiiiii)))+ii;
.+=;))iiiiii)));ii+
.+=i:)))))))=+ii+
.;==i+::::=)i=;
,+==iiiiii+,
`+=+++;`
What happend?
----------------------------------------------
All Your files has been succesfully encrypted by AstraLocker 2.0
Can I get My files back?
----------------------------------------------
Sure! But You dont have much time for this.
Your computer is infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without my help.
What can I do to get my files back?
----------------------------------------------
You can buy my decryption software, this software will allow you to recover all of your data and remove the Ransomware from your computer.
The price for the software is about 50$ (USD). Payment can be made in Monero, or Bitcoin (Cryptocurrency) only.
What guarantees?
----------------------------------------------
I value my reputation. If i do not do my work and liabilities, nobody will pay me. This is not in my interests.
All my decryption software is perfectly tested and will decrypt your data.
How do I pay, where do I get Monero or Bitcoin?
----------------------------------------------
Purchasing Monero or Bitcoin varies from country to country, you are best advised to do a quick Google search
yourself to find out how to buy Monero or Bitcoin.
Amount of Bitcoin to pay: 0,0012 (Bitcoin)
or
Amount of Monero to pay: 0,30 (XMR)
Where i can pay?
----------------------------------------------
Monero Address:
47moe29QP2xF2myDYaaMCJHpLGsXLPw14aDK6F7pVSp7Nes4XDPMmNUgTeCPQi5arDUe4gP8h4w4pXCtX1gg7SpGAgh6qqS
Bitcoin Addres:
bc1qpjftnrmahzc8cjs23snk2rq0vt6l0ehu4gqxus
Contact
----------------------------------------------
After payment contact:
AstraLocker@
or
astralocker@
to get the decryptor
The best way is contact both.
Warning! If you report these emails, they may be suspended and NOBODY gets help.
It is in Your INTEREST to get the decryptor.
Do NOT:
1)Change the extension of the files. You can harm it.
2)Move encrypted files
3)Try to recover files by Yourself. It is impossible. Your files are encrypted with Curve25519 encryption algorithm, You can't decrypt files without private key.
Signatures
-
Babuk Locker
RaaS first seen in 2021 initially called Vasa Locker.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6.exe"C:\Users\Admin\AppData\Local\Temp\08565f345878369fdbbcf4a064d9f4762f4549f67d1e2aa3907a112a5e5322b6.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
284KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
880KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1024KB
-
Filesize
1.5MB
-
Filesize
1.0MB
-
Filesize
644KB
-
Filesize
1.1MB
-
Filesize
1024KB
-
Filesize
880KB