General

  • Target

    HEUR-Trojan-Ransom.MSIL.Encoder.gen-5458f18e36de21d20b713f7acd8575fc8a86330c466e1b9dc6f41bc81f3e79fc.exe

  • Size

    100KB

  • Sample

    220924-lm7xvsccfl

  • MD5

    7fdd3bf8886199e8336f95c88bcaa49a

  • SHA1

    77e2019093379de4d5de07dbcf5893831c9bb7ec

  • SHA256

    5458f18e36de21d20b713f7acd8575fc8a86330c466e1b9dc6f41bc81f3e79fc

  • SHA512

    9d774eca21fb33f26991cf20f0f6a2f0bce56aa4cc3d17fd769e0bb767ca400cd5c8dd64bb62db23bf5bc112b91b1a26db7bf2f9d85993cb990be5113e527a40

  • SSDEEP

    1536:1zmSA404oATJVPHEMXMxa6CO3/k/hdXVyczH+95DfFFjfuEnm:1zxEYsZaLhdlo95DfFFjfuCm

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Ransom Note
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail kingstonbtc@tutanota.com or: pandabit@tuta.io (Backup mail) Send us this file RESTORE_FILES_INFO ================================================================================================================= Free decryption as a guarantee Before paying, you can send 1-2 files for free decryption. File format: txt doc pdf jpeg jpg gif png bmp Total file size should not exceed 2 MB (without archive) ====================================================== You can buy Bitcoins here: https://localbitcoins.com Or use the search how to buy Bitcoins in your country ================================================================================================================= IMPORTANT!!! Remember that your files are encrypted and only WE can recover them! Do not try to recover yourself, as well as on third-party resources, you will lose your files and money forever! ================================================================================================================= Key Identifier: 0o5Ami/gRJZd1rNbHKI/ZIf/8yLQP0QRV3YmU/NaBz51UR44e+fHtBJn6GhNf/uAsIDPzrkx3RHfHTn9xMeMXgYLeLUirJCqoV6LAoBOGcnqQ1fS2gQdUKm57dioTJF8ePW0iJWgut++fAEZ2JdGzVtn5T0uMzuJ+YQTY3yYwS64hMSuqy9vMtVIj6jwQuaytDUX5dpS+jSSOFI2Az9cTkttxUJ22CfqaPdx3nR8vxVbCThqUmA6a/sKY/VXCSZUiTck57oaVGNgePINYZhjfE30Vv11K9fJ92Ihx5izWWERaaUmsoVuUfsdMTzioj/eORevPiiz3av+lMs9zHAx3roQxJPMqbh+U/NjDsCLeULKAXT4hVfyidNV4VqqlBhjW5iBvn3ea67T/dXxt6BXijW1U/NmsWMdzIiYY7m1BHsQ4lDcPUlEKDqeq5zI5PpSH/GUBKUXv6+X3aywnCNpfnkCGFnsCsAEjR4NvchXTqgqZEu2z6J9cmgpKbz6Iem+ZPrk72M9Hn6La0EndJTvQcsWf7n2bfKW2W0QxTjsPFpMyqmvkIBtcEm7GAr9p2jF1Vf5FVCHsXjLoRI+rxFQyjfWB7qByzEqBh61xhrPlNsKcc9C1BWQsB10M5L3U1j+MJTbVr8eBK4m24+k2lKlOGl096dRJo2H+uiG/lJPT/A= PC Hardware ID: 94A7BB46
Emails

kingstonbtc@tutanota.com

pandabit@tuta.io

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt

Ransom Note
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail kingstonbtc@tutanota.com or: pandabit@tuta.io (Backup mail) Send us this file RESTORE_FILES_INFO ================================================================================================================= Free decryption as a guarantee Before paying, you can send 1-2 files for free decryption. File format: txt doc pdf jpeg jpg gif png bmp Total file size should not exceed 2 MB (without archive) ====================================================== You can buy Bitcoins here: https://localbitcoins.com Or use the search how to buy Bitcoins in your country ================================================================================================================= IMPORTANT!!! Remember that your files are encrypted and only WE can recover them! Do not try to recover yourself, as well as on third-party resources, you will lose your files and money forever! ================================================================================================================= Key Identifier: 0o5Ami/gRJZd1rNbHKI/ZIf/8yLQP0QRV3YmU/NaBz51UR44e+fHtBJn6GhNf/uAsIDPzrkx3RHfHTn9xMeMXgYLeLUirJCqoV6LAoBOGcnqQ1fS2gQdUKm57dioTJF8ePW0iJWgut++fAEZ2JdGzVtn5T0uMzuJ+YQTY3yYwS64hMSuqy9vMtVIj6jwQuaytDUX5dpS+jSSOFI2Az9cTkttxUJ22CfqaPdx3nR8vxVbCThqUmA6a/sKY/VXCSZUiTck57oaVGNgePINYZhjfE30Vv11K9fJ92Ihx5izWWERaaUmsoVuUfsdMTzioj/eORevPiiz3av+lMs9zHAx3roQxJPMqbh+U/NjDsCLeULKAXT4hVfyidNV4VqqlBhjW5iBvn3ea67T/dXxt6BXijW1U/NmsWMdzIiYY7m1BHsQ4lDcPUlEKDqeq5zI5PpSH/GUBKUXv6+X3aywnCNpfnkCGFnsCsAEjR4NvchXTqgqZEu2z6J9cmgpKbz6Iem+ZPrk72M9Hn6La0EndJTvQcsWf7n2bfKW2W0QxTjsPFpMyqmvkIBtcEm7GAr9p2jF1Vf5FVCHsXjLoRI+rxFQyjfWB7qByzEqBh61xhrPlNsKcc9C1BWQsB10M5L3U1j+MJTbVr8eBK4m24+k2lKlOGl096dRJo2H+uiG/lJPT/A= Number of files that were processed is: 589 PC Hardware ID: 94A7BB46
Emails

kingstonbtc@tutanota.com

pandabit@tuta.io

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Ransom Note
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail kingstonbtc@tutanota.com or: pandabit@tuta.io (Backup mail) Send us this file RESTORE_FILES_INFO ================================================================================================================= Free decryption as a guarantee Before paying, you can send 1-2 files for free decryption. File format: txt doc pdf jpeg jpg gif png bmp Total file size should not exceed 2 MB (without archive) ====================================================== You can buy Bitcoins here: https://localbitcoins.com Or use the search how to buy Bitcoins in your country ================================================================================================================= IMPORTANT!!! Remember that your files are encrypted and only WE can recover them! Do not try to recover yourself, as well as on third-party resources, you will lose your files and money forever! ================================================================================================================= Key Identifier: AFJ9Rf6QPU8eUI//ONFJSZQs0rF5POLCQZK3FOdCCoZybsr1VA5c7NzesWftkrFAvUKUlmde21ip45qMqR7yBBkucWdYv5TE3q9pWVcZxaZUyYdj2F4PuhzvIvvL7hJeRX9UE4MNbZ4suHhIhaA93YqE/QVLSwuiZORhxAgLGyMTc+j3lL9gHSDpz2+XuVA5PkwSnMOFWG4dAlL2q/sfXHmp/u0EZxD3VUOUeehIb8W2fbGsrrlGYRUXtDIMpqDYir43ADH7JiAUXo7bwK6Q5mToKmdHEQTLAPOG85smvbi8cvSFvWSuGKasAdM+h++UWREI4OIKoGa+vTbywU2J8zdosaFInCc14qeAtHS6HegxSeG9Jk1tXLYrw/yNdw9xHJnnm56yC31N+/FekSX/AuxOLzxeWVVpSPhcExQ3DmtyMUrpcew9X21wKDZBfR9u7cw7gwGmWkukUue801JP+1ronWnVj397KStK6z8OeLJqUbrCgw9s8wDkQDcF9FPg3oVed08jKkZP28pGs9UbVXQ7+6vbCTeNPS/ZsEOrqEqQUUZDBkgSXU1G+unvKVXyJu+ASxN9gezGEQHwA+tNhjbe/Jaoay/uypiCHDhM3zs3X6OPessss1fltLxTIzHPZXp5L/zuAZzHCk4C+inghsjJf0y3VtZKjJT6SRifptc= PC Hardware ID: 2C4BFA22
Emails

kingstonbtc@tutanota.com

pandabit@tuta.io

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt

Ransom Note
All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail kingstonbtc@tutanota.com or: pandabit@tuta.io (Backup mail) Send us this file RESTORE_FILES_INFO ================================================================================================================= Free decryption as a guarantee Before paying, you can send 1-2 files for free decryption. File format: txt doc pdf jpeg jpg gif png bmp Total file size should not exceed 2 MB (without archive) ====================================================== You can buy Bitcoins here: https://localbitcoins.com Or use the search how to buy Bitcoins in your country ================================================================================================================= IMPORTANT!!! Remember that your files are encrypted and only WE can recover them! Do not try to recover yourself, as well as on third-party resources, you will lose your files and money forever! ================================================================================================================= Key Identifier: AFJ9Rf6QPU8eUI//ONFJSZQs0rF5POLCQZK3FOdCCoZybsr1VA5c7NzesWftkrFAvUKUlmde21ip45qMqR7yBBkucWdYv5TE3q9pWVcZxaZUyYdj2F4PuhzvIvvL7hJeRX9UE4MNbZ4suHhIhaA93YqE/QVLSwuiZORhxAgLGyMTc+j3lL9gHSDpz2+XuVA5PkwSnMOFWG4dAlL2q/sfXHmp/u0EZxD3VUOUeehIb8W2fbGsrrlGYRUXtDIMpqDYir43ADH7JiAUXo7bwK6Q5mToKmdHEQTLAPOG85smvbi8cvSFvWSuGKasAdM+h++UWREI4OIKoGa+vTbywU2J8zdosaFInCc14qeAtHS6HegxSeG9Jk1tXLYrw/yNdw9xHJnnm56yC31N+/FekSX/AuxOLzxeWVVpSPhcExQ3DmtyMUrpcew9X21wKDZBfR9u7cw7gwGmWkukUue801JP+1ronWnVj397KStK6z8OeLJqUbrCgw9s8wDkQDcF9FPg3oVed08jKkZP28pGs9UbVXQ7+6vbCTeNPS/ZsEOrqEqQUUZDBkgSXU1G+unvKVXyJu+ASxN9gezGEQHwA+tNhjbe/Jaoay/uypiCHDhM3zs3X6OPessss1fltLxTIzHPZXp5L/zuAZzHCk4C+inghsjJf0y3VtZKjJT6SRifptc= Number of files that were processed is: 1067 PC Hardware ID: 2C4BFA22
Emails

kingstonbtc@tutanota.com

pandabit@tuta.io

Targets

    • Target

      HEUR-Trojan-Ransom.MSIL.Encoder.gen-5458f18e36de21d20b713f7acd8575fc8a86330c466e1b9dc6f41bc81f3e79fc.exe

    • Size

      100KB

    • MD5

      7fdd3bf8886199e8336f95c88bcaa49a

    • SHA1

      77e2019093379de4d5de07dbcf5893831c9bb7ec

    • SHA256

      5458f18e36de21d20b713f7acd8575fc8a86330c466e1b9dc6f41bc81f3e79fc

    • SHA512

      9d774eca21fb33f26991cf20f0f6a2f0bce56aa4cc3d17fd769e0bb767ca400cd5c8dd64bb62db23bf5bc112b91b1a26db7bf2f9d85993cb990be5113e527a40

    • SSDEEP

      1536:1zmSA404oATJVPHEMXMxa6CO3/k/hdXVyczH+95DfFFjfuEnm:1zxEYsZaLhdlo95DfFFjfuCm

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops startup file

    • Modifies file permissions

    • Modifies WinLogon

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Winlogon Helper DLL

1
T1004

Defense Evasion

File Permissions Modification

1
T1222

Modify Registry

3
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Tasks