Resubmissions

29-09-2022 00:29

220929-as31bahde7 10

25-09-2022 15:03

220925-se2t7sgdap 10

General

  • Target

    locker.bin.zip

  • Size

    86KB

  • Sample

    220925-se2t7sgdap

  • MD5

    7ac82788846db468840a7b437259387c

  • SHA1

    a6a358ae850c741f1955d10d30876f791657b8d8

  • SHA256

    9fc79081e2f45a341ff9ab054413d6b5e561daaec27fdd6aefaffc77cf7509b4

  • SHA512

    5c05b16826ddaec1342f86a917bae118308992f4aa34d5cc4a079f9e6cae3b476da9614cbb4c4ec6ec3e498ecdaef887ba4cfbb6ef7b39a39fb781a139af9931

  • SSDEEP

    1536:zD4Co484SjMVsj9SX/2dwSY9ztV2suCrWuHQgobis3AZiMTmfHExXKIcyBnr97:ICo48hYVsZSX/229zXWkEmmSmfHyDR7

Malware Config

Extracted

Path

C:\warning !!!! Readme bl00dy Gang.txt

Ransom Note
GREETINGS FROM BL00DY RANSOMWARE GANG What happened ? Your entire company network is penetrated and encrypted. All files on servers and computers locked and not usable Dont panic All files are decryptable We will recover all your files to normal What Bl00dy Gang take / steal from your company network ? We download your company important files / documents / databases/ mails / accounts We publish it to the public if you dont cooperate . What BL00DY Gang needs from YOU ? We expect nothing except appreciating our work PAY US in this way you appreciate our work How to contact the BL00DY Gang for ransom negotiations ? filedecryptionsupport@msgsafe.io Telegram hall of shame , where all company private data will be PUBLISHED?? https://t.me/bl00dy_Ransomware_Gang What Quarantees ? we are not a politically motivated group and we do not need anything other than your money. If you pay, we provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We will help protect your company from any other attacks ; we will give you tips to secure company network We always keep our promises. !!! BEWARE !!! If you have Backups and try to restore from backups . All entire company files / databases / everything will be posted online DON'T try to rename or modify encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! - Don't try because you will damage all the files Any changes in encrypted files may entail damage of the private key and, as result, the loss all data. Do not report to Police or FBI , they dont care about your business .They will tell you not to pay and you will lose all your files. Recovery Company Cannot help You . things will get rather worse . speak for yourself.
Emails

filedecryptionsupport@msgsafe.io

URLs

https://t.me/bl00dy_Ransomware_Gang

Targets

    • Target

      locker.bin

    • Size

      178KB

    • MD5

      8d27d0c897ce21f1036bf659fc663cf2

    • SHA1

      afe3d0fb48092aeca4dcd3989a076e87fdbe69b2

    • SHA256

      139a8bb2c5537190e747d2f651b423147018fd9a9a21bb36281d4ce1c61727c1

    • SHA512

      531873e8faaf801a447f70848969865750f41fd5ff15bd8c47015e766a9bb8cc1fbb8dcae16ddbf1e4f9dbc5750af593ef8fdcf94cd1a61efa00c7790cda4374

    • SSDEEP

      3072:/gq2DKdMbv1S/n6rHBJK3V9LBSLrKa+HQXvMES/D3Yw7yZyYpEaI:/84X/19LUPMcMEw3kTI

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Tasks