General

  • Target

    WindowsRuntimeSecurity.bin.zip

  • Size

    8KB

  • Sample

    221009-w57d6ahdg4

  • MD5

    2dbf428927fb3b2d587f457cf5664582

  • SHA1

    fbad63c3e37fa265cc81f0b789ccb59016501604

  • SHA256

    d66e28e2ae3a6287740d4f67c722f4e5f9db0cebec101380bdbf46ae76da6fe0

  • SHA512

    1e74b2976239098e480d03b2f87a43ebee36f11743bece04dbfa2a27368dd898f7ba4d5a91ac7ffb9cc730ae6ac74dca5c86c39637889281ec83637a25a0adf4

  • SSDEEP

    192:0d6Vt1X1kK9VgEgf/ug3KBRPUJh8Dy5Ad1sJmBPAktBLdP:0d67TgEtBRsgDaJahndP

Malware Config

Extracted

Path

C:\$Recycle.Bin\ALL_OF_YOUR_FILES_ARE_ENCRYPTED_README.txt

Ransom Note
___ ___________________ ________________ _ ____ / |/_ __/_ __/ ____/ | / /_ __/ _/ __ \/ | / / / / /| | / / / / / __/ / |/ / / / / // / / / |/ / / / ___ |/ / / / / /___/ /| / / / _/ // /_/ / /| /_/ /_/ |_/_/ /_/ /_____/_/ |_/ /_/ /___/\____/_/ |_(_) π˜ˆπ˜“π˜“ π˜–π˜ π˜ π˜–π˜œπ˜™ π˜π˜π˜“π˜Œπ˜š 𝘏𝘈𝘝𝘌 π˜‰π˜Œπ˜Œπ˜• π˜Œπ˜•π˜Šπ˜™π˜ π˜—π˜›π˜Œπ˜‹ π˜‰π˜  π˜—π˜Άπ˜³π˜±π˜­π˜¦π˜Šπ˜’π˜΄π˜€π˜’π˜₯𝘦! YOUR FILES HAVE BEEN ENCRYPTED WITH MILITARY-GRADE ENCRYPTION ALGORITHM AND IS PERMANENTLY ENCRYPTED UNLESS YOU PAY FOR OUR SERVICES! Q.1> What happened? ---> All of your sensitive files have been encrypted by PurpleCascade ransomware. You cannot decrypt your files without our special decryption tool. Q.2> How can I get back my files? ---> You can get back your files only if you pay for our decryption tool. The price for our decryption tool is $1,200 and can be purchased only using Monero. Attempting to decrypt your files without our service will only permanently damage your files even more, making it impossible to recover even with our decryption tool. Also, PLEASE SPECIFY YOUR VERSION OF PURPLECASCADE BELOW!!! Q.3> How can I pay? ---> As mentioned above, you need to pay us $1,500 in Monero. You can get customer support via qTox, our ID is 0F87E1BAF92E5535EB9D097374150FC7E97F54C97EFB6A5A202F632B6EFD3C28F15588421ACB. Download qTox from: https://tox.chat/download.html (π™Žπ™€π™‡π™€π˜Ύπ™ π™Šπ™‰π™‡π™” 𝙦𝙏𝙀𝙭!). We will send you the XMR address you should pay us to, and also guide you on transaction, and give you free technical support. Q.4> Can I trust this process? ---> Of course you can! Our decryption tools have been tested and work 100%, and we will surely give you decryption tool when you will pay us. We DO NOT scam people as then no one will pay us in return. PurpleCascade version: CVXC
URLs

https://tox.chat/download.html

Targets

    • Target

      WindowsRuntimeSecurity.bin

    • Size

      18KB

    • MD5

      7799cb222f53fdea43585f7d40104ed6

    • SHA1

      28d6fc08e1571db3c6358c4b3b6687517afb04ec

    • SHA256

      38ccc368bf474e923dae79501b03b4c5cc62bf57890a99bd4b0a8b3867630e42

    • SHA512

      101cdcbb66655065ca35985efd82862a626a3bf3d080f41713b5ca41f6861169a1f02a8e6d6b23dee65fb740d63af5e46f936b3bfd84537b8580d4b30060bc4f

    • SSDEEP

      384:RixYSYy3Wd/xVAngX0GEmKPK7fUl49cHFMemGCI/mP4:mFYy3QxVRpqGe498MemrP4

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks