6b6158f74dbd43b8c839d5ae65d33ae9a11c9e3cef5fa52d86105983a67cdc4f

General

Target

HEUR-Trojan-Ransom.MSIL.Gen.gen-6b6158f74dbd43b8c839d5ae65d33ae9a11c9e3cef5fa52d86105983a67cdc4f.exe
Size

171KB
Sample

220924-lm7xvsbaa6
MD5

d3d0035a769e6ef98b1433160b2c8333
SHA1

be1d0aed32308166721d4756e2216dc44c2d0baa
SHA256

6b6158f74dbd43b8c839d5ae65d33ae9a11c9e3cef5fa52d86105983a67cdc4f
SHA512

b86b1ab9ad2c4c851c8712d0e49321cd3f9671815592bd4228664d236093cbb904f091dc7ad60815a56da5f9face2ce11fbd84790afca4d480ae17fa76dcb229
SSDEEP

384:LFLGX7oV+D2DBn4f+yJZcccccJcccctJZcccccJccccFJZcccccJccccFJZcccc9:LFLuk1DN4f+NEL

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\README-MCBURGLAR.txt

Ransom Note

___ ___ (o o) (o o) ( V ) !!! ATTENTION !!! ( V ) --m-m-----------------------m-m-- ▄· ▄▌ ▄• ▄▌ ▄ .▄ ▄▄▄· ▌ ▐·▄▄▄ . ▄▄▄▄· ▄▄▄ .▄▄▄ . ▐ ▄ ▄▄▄▄· ▄▄▄ ▄▄▄ . ▄▄▄· ▄▄· ▄ .▄▄▄▄ .·▄▄▄▄ ▐█▪██▌ ▄█▀▄ █▪██▌ ██▪▐█▐█ ▀█ ▪█·█▌▀▄.▀· ▐█ ▀█▪▀▄.▀·▀▄.▀·•█▌▐█ ▐█ ▀█▪▀▄ █·▀▄.▀·▐█ ▀█ ▐█ ▌▪██▪▐█▀▄.▀·██· ██ ▐█▌▐█▪▐█▌.▐▌█▌▐█▌ ██▀▀█▄█▀▀█ ▐█▐█•▐▀▀▪▄ ▐█▀▀█▄▐▀▀▪▄▐▀▀▪▄▐█▐▐▌ ▐█▀▀█▄▐▀▀▄ ▐▀▀▪▄▄█▀▀█ ██ ▄▄██▀▀█▐▀▀▪▄▐█▪ ▐█▌ ▐█▀·.▐█▌.▐▌▐█▄█▌ ██▌▐▀▐█▪ ▐▌ ███ ▐█▄▄▌ ██▄▪▐█▐█▄▄▌▐█▄▄▌██▐█▌ ██▄▪▐█▐█•█▌▐█▄▄▌▐█▪ ▐▌▐███▌██▌▐▀▐█▄▄▌██. ██ ▀ • ▀█▄▀▪ ▀▀▀ ▀▀▀ · ▀ ▀ . ▀ ▀▀▀ ·▀▀▀▀ ▀▀▀ ▀▀▀ ▀▀ █▪ ·▀▀▀▀ .▀ ▀ ▀▀▀ ▀ ▀ ·▀▀▀ ▀▀▀ · ▀▀▀ ▀▀▀▀▀• ▄▄▄·▄▄▄ ▄▄▄· ▌ ▐· ▐ ▄ ▄▄▄· by ▐█ ▄█▀▄ █·▐█ ▀█ ▪█·█▌ ▄█▀▄ •█▌▐█▐█ ▀█ ██▀·▐▀▀▄ ▄█▀▀█ ▐█▐█•▐█▌.▐▌▐█▐▐▌▄█▀▀█ ▐█▪·•▐█•█▌▐█▪ ▐▌ ███ ▐█▌.▐▌██▐█▌▐█▪ ▐▌ .▀ .▀ ▀ ▀ ▀ . ▀ ▀█▄▀▪▀▀ █▪ ▀ ▀ ✩░▒▓▆▅▃▂▁𝐰𝐡𝐚𝐭 𝐡𝐚𝐩𝐩𝐞𝐧𝐞𝐝 ?▁▂▃▅▆▓▒░✩ YOUR NETWORK HAS BEEN INFILTRATED, AND WE HAVE ACCESSED ALL YOUR DATA ✩░▒▓▆▅▃▂▁𝐰𝐡𝐚𝐭 𝐝𝐨𝐞𝐬 𝐭𝐡𝐢𝐬 𝐦𝐞𝐚𝐧?▁▂▃▅▆▓▒░✩ IT MEANS THAT SOON YOUR PARTNERS, CLIENTS, BOARD AND MASS MEDIA WILL KNOW OF YOUR PROBLEM ✩░▒▓▆▅▃▂▁𝐡𝐨𝐰 𝐜𝐚𝐧 𝐢𝐭 𝐛𝐞 𝐚𝐯𝐨𝐢𝐝𝐞𝐝 ?▁▂▃▅▆▓▒░✩ IN ORDER TO AVOID ISSUE YOU ARE TO CONTACT US NO LATER THAN 3 DAYS AND CONCLUDE DATA RECOVERY AND AGREEMENT✩░▒▓▆▅▃▂▁𝐰𝐡𝐚𝐭 𝐢𝐟 𝐢 𝐝𝐨 𝐧𝐨𝐭 𝐜𝐨𝐧𝐭𝐚𝐜𝐭 𝐲𝐨𝐮?▁▂▃▅▆▓▒░✩ IF YOU DO NOT CONTACT US IN THE NEXT 3 DAYS WE WILL BEGIN DATA PUBLICATION ✩░▒▓▆▅▃▂▁𝐡𝐨𝐰 𝐝𝐨 𝐢 𝐜𝐨𝐧𝐭𝐚𝐜𝐭 𝐲𝐨𝐮 ?▁▂▃▅▆▓▒░✩ WIZE CHOICE, THERE IS FEW WAY TO DO THIS I. RECOMMENDED (MOST SECURE METHOD) a) DOWNLOAD TOR BROWSER (https://www.torproject.org/download/) b) INSTALL THE TOR BROWSER c) OPEN OUR WEBSITE WITH LIVE CHAT IN THE TOR BROWSER (http://XXXXXXXXXXXXXXXXXXXX.onion) d) FOLLOW THE INSTRUCTIONS ON THIS PAGE II. IF THIS METHOD IS NOT SUITABLE FOR YOU OR TOR IS BLOCKED IN YOUR COUNTRY a) OPEN OUR WEBPAGE WITH LIVE CHAT (https://XXXXXXXXXXXXXXXXXX.onion) b) FOLLOW INSTRUCTION ON PAGE

URLs

http://XXXXXXXXXXXXXXXXXXXX.onion

https://XXXXXXXXXXXXXXXXXX.onion

Targets

- Target
  
  HEUR-Trojan-Ransom.MSIL.Gen.gen-6b6158f74dbd43b8c839d5ae65d33ae9a11c9e3cef5fa52d86105983a67cdc4f.exe
- Size
  
  171KB
- MD5
  
  d3d0035a769e6ef98b1433160b2c8333
- SHA1
  
  be1d0aed32308166721d4756e2216dc44c2d0baa
- SHA256
  
  6b6158f74dbd43b8c839d5ae65d33ae9a11c9e3cef5fa52d86105983a67cdc4f
- SHA512
  
  b86b1ab9ad2c4c851c8712d0e49321cd3f9671815592bd4228664d236093cbb904f091dc7ad60815a56da5f9face2ce11fbd84790afca4d480ae17fa76dcb229
- SSDEEP
  
  384:LFLGX7oV+D2DBn4f+yJZcccccJcccctJZcccccJccccFJZcccccJccccFJZcccc9:LFLuk1DN4f+NEL
Score

10^/10

ransomware spyware stealer
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Modifies extensions of user files

Reads user/profile data of web browsers

Drops desktop.ini file(s)

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2