General

  • Target

    HEUR-Trojan-Ransom.Win32.Generic-6a52b9cd66ae94e8d27eb0bc3a63e6bd2c3ba6903637533a554d786e00af2404.exe

  • Size

    433KB

  • Sample

    220924-lm7xvsccfn

  • MD5

    7273bcc0c3c3cc89a922c9eb2cc6797e

  • SHA1

    6bf35f44a2267755c2646c89c836bd618c4e964c

  • SHA256

    6a52b9cd66ae94e8d27eb0bc3a63e6bd2c3ba6903637533a554d786e00af2404

  • SHA512

    c344cd1ee725f76f64888805e0310fddf39e9946884298d05aab6f4d8b43af44191ac3402a2c7758b2b0680e4fbcefc08dd7c155397d21f6b314363f018b2725

  • SSDEEP

    12288:ZIEFNyLxXcP/bBwW4l4xSMz47ao0Hu4l:ZIEzZeWnxSE4Ooq

Score
10/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\ReadMe.txt

Ransom Note
---------------------------------------- Venus Locker ------------------------------------ Korean: https://hastebin.com/semoseguli.pl Japanese: https://hastebin.com/pifegafupi.scala French: https://hastebin.com/uxuxoqikon.scala Chinese: https://hastebin.com/rocukapaga.scala Italian: https://hastebin.com/igeyejigef.erl Unfortunately, you are hacked. 1. What happened to my files? Your personal files, including your photos, documents, videos and other important files on this computer, have been encrypted with RSA-2048, a strong encryption algorithm. RSA algorithm generates a public key and a private key for your computer. The public key was used to encrypt your files a moment ago. The private key is necessary for you to decrypt and recover your files. Now, your private key is stored on our secret Internet server. And there is no doubt that no one can recover your files without your private key. For further information about RSA algorithm, please refer to https://en.wikipedia.org/wiki/RSA_(cryptosystem) 2. How to decrypt my files? To decrypt and recover your files, you have to pay 1 BTC (Bitcoin) for the private key and decryption service. Please note that you have ONLY 72 HOURS to complete your payment. If your peyment do not be completed within time limit, your private key will be deleted automatically by our server. All your files will be permanently encrypted and nobody can recover them. Therefore, it is advised that you'd better not waste your time, because there is no other way to recover your files except making a payment. 3. How to pay for my private key? There are three steps to make a payment and recover your files: 1). For the security of transactions, all the payments must be completed via Bitcoin network. Thus, you need to exchange some money to 1 Bitcoin, and then send these Bitcoins to the following address. 16jvWspVfvhjRgJhGCDETf29cjQAyNmx9G 2). Send your personal ID to our official email: venuslocker@torbox3uiot6wchz.onion Your personal ID is 3). You will receive a decryptor and your private key to recover all your files within one working day. 4. What is Bitcoin? Bitcoin is an innovative payment network and a new kind of money. It is based on an open-source cryptographic protocol that is independent of any central authority. Bitcoins can be transferred through a computer or a smartphone withour an intermediate financial institution. 5. How to make a payment with Bitcoin? You can make a payment with Bitcoin based on Bitcoin Wallet or Based on Perfect Money. You can choose the way that is more convenient for you. About Based on Bitcoin Wallet 1) Create a Bitcoin Wallet. We recommend Blockchain.info (https://blockchain.info/) 2) Buy necessary amount of Bitcoins. Our recommendations are as follows. LocalBitcoins.com -- the fastest and easiest way to buy and sell Bitcoins. CoinCafe.com -- the simplest and fastest way to buy, sell and use Bitcoins. BTCDirect.eu -- the best for Europe. CEX.IO -- Visa / MasterCard CoinMama.com -- Visa / MasterCard HowToBuyBitcoins.info -- discover quickly how to buy and sell Bitcoins in your local currency. 3) As mentioned above, send about 1 BTC to our Bitcoin receiving address. 4) As mentioned above, and then, send us your personal ID via email, you will receive your private key soon. About Based on Perfect Money 1) Create a Perfect Money account. (https://perfectmoney.is) 2) Visit to PMBitcoin.com. (https://pmbitcoin.com/btc) input our Bitcoin receiving address in the "Bitcoin Wallet" textbox. input 1 in the "BTC" textbox, the amount of USD will be calculated automatically. click "PAY" button, then you can complete you payment with your Perfect Money account and local debit card. 6. If you have any problem, please feel free to contact us via official email. Best Regards VenusLocker Team
Emails

venuslocker@torbox3uiot6wchz.onion

Wallets

16jvWspVfvhjRgJhGCDETf29cjQAyNmx9G

URLs

https://hastebin.com/semoseguli.pl

https://hastebin.com/pifegafupi.scala

https://hastebin.com/uxuxoqikon.scala

https://hastebin.com/rocukapaga.scala

https://hastebin.com/igeyejigef.erl

https://perfectmoney.is

https://pmbitcoin.com/btc

Targets

    • Target

      HEUR-Trojan-Ransom.Win32.Generic-6a52b9cd66ae94e8d27eb0bc3a63e6bd2c3ba6903637533a554d786e00af2404.exe

    • Size

      433KB

    • MD5

      7273bcc0c3c3cc89a922c9eb2cc6797e

    • SHA1

      6bf35f44a2267755c2646c89c836bd618c4e964c

    • SHA256

      6a52b9cd66ae94e8d27eb0bc3a63e6bd2c3ba6903637533a554d786e00af2404

    • SHA512

      c344cd1ee725f76f64888805e0310fddf39e9946884298d05aab6f4d8b43af44191ac3402a2c7758b2b0680e4fbcefc08dd7c155397d21f6b314363f018b2725

    • SSDEEP

      12288:ZIEFNyLxXcP/bBwW4l4xSMz47ao0Hu4l:ZIEzZeWnxSE4Ooq

    Score
    10/10
    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

File Deletion

1
T1107

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Impact

Inhibit System Recovery

1
T1490

Defacement

1
T1491

Tasks