General

  • Target

    d2203b6d272d44b7abc66e290c3b79767428168b077a16ded1db0babbe34f333.exe

  • Size

    158KB

  • Sample

    221011-je84vacefm

  • MD5

    3c4fa896e819cb8fada88a6fdd7b2cc7

  • SHA1

    0ebf10867534cb472bb98344f80e3a8aac0aa507

  • SHA256

    d2203b6d272d44b7abc66e290c3b79767428168b077a16ded1db0babbe34f333

  • SHA512

    e4486c33fc7bf99700fabec50ead10a6159758603d50eabe650436098a977b8c9dc728d0e8dbc3e3718393a7ba67cca8ea2799ef83e9194f178f04ae9784473e

  • SSDEEP

    3072:Wkb6bwPcmQ1mbTw8Gt189VTG079sTGyAzbnuvXdIR:WkTPcmscw/1ETGgWGy0uvC

Malware Config

Extracted

Path

C:\Documents and Settings\Admin\WANNA_RECOVER_KOXIC_FILEZ_NOMIO.txt

Ransom Note
--=== Hello ===--- [+] Whats Happen? [+] Your sensitive information and data were downloaded. Your files are encrypted, and currently unavailable just so you can contact us faster. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] We are not interested in distributing information, we are interested in agreeing with you - these are your guarantees. Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should send sample to us to decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise-time is much more valuable than money. [+] How to contact us? [+] Just write us an email to [email protected] [+] Consequences if we do not find a common language [+] 1. The data were irretrievably lost. 2. Leaked data will be published or sold on blmarket (or to competitors). 3. In some cases, DDOS attacks will be applied to your inftastructure. !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! Your UserID: 96E9709A74D71ABDF825D393D699FD03DD93B0F859C73D89F6CBD1E2721E4205535EC777B15E4485B4 FAADF7F387011B871AC998D2C1F25197B6F3ACCD9532ED5970D1A642DC9B68C437515A31BB73AE9DCE 0C6DAAF16B8A99EEE802FA27356D5F63469D50146F2582C91F2C99CB688D050913F42B820170A656AD D2ADFA92A887989B4B2EA97A54C6A89CE6E449CBA99B571A0A5657ED232F6187BBC477E105105F9EC4 F9DB708509AF82ABC1110F9D80978ACE9406F5A68A653641CCAEF28E7B0606BA05C059585589A6E725 91DDB88821D59CFB45A918CFDEAF12F40DBCD5AA1880AE33AA1458D4E65D18285B6D8B28BA29E6FDB5 4DC4EC479AABC61C4D333082010A0282010100D622B29E49FB50795294EE83AE0CE8A138DBB30A07CE 76F069ABC1CABF1CC01FD53BCB6B6071150D5F1C8E86155865A49514440DDCC42643C62F3C93CE0A2E FB33F21D902B05DDB5EC33FE498A46146C3E6CDA5BC4697D8ACEF63229825476FE2A6838FFC83939FD 1B51DFA3A7A2B43E72647B8FBAF95C16EFE1ECC4233145301334BED1A040494771CFF4B4A8B0FDEAAB 02AF74BA0C0C9FC245C57F462C2DABDEAE1DC91E1D74BD059E903F0395877A89B34DE52DE1D7B4685D 2715DD3AAE2A8ADD0667CCA819DECC28E3F76C6EE50FE1607B128F5B6BCE7DDCCEC90CB35BDB875E3E 37B1E42CB0544B5A200E8DE8A7CAD22428EB173265F88FEE4D2EEA615502030100014443308DE61D1B EEF901F7C4EB4CAB124E4F4D494F

Extracted

Path

C:\Documents and Settings\WANNA_RECOVER_KOXIC_FILEZ_KATHC.txt

Ransom Note
--=== Hello ===--- [+] Whats Happen? [+] Your sensitive information and data were downloaded. Your files are encrypted, and currently unavailable just so you can contact us faster. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] We are not interested in distributing information, we are interested in agreeing with you - these are your guarantees. Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should send sample to us to decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise-time is much more valuable than money. [+] How to contact us? [+] Just write us an email to [email protected] [+] Consequences if we do not find a common language [+] 1. The data were irretrievably lost. 2. Leaked data will be published or sold on blmarket (or to competitors). 3. In some cases, DDOS attacks will be applied to your inftastructure. !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! Your UserID: 24EADD82FBA2824EC1E638D92FE04653ED363AE7D9FC8D3C673E8D9E657F6D71A8011B534CFD9845E9 163EA8E62A04A7D87B84E84546B09EF384B2C6210882525247297BC989CD9A4E93C477084813F63F3D F5326526278E008AC844BD659929602AF573C52FF57BBB62A0F88BB679154612C9FC356CC8E6253D72 245C6AEA287C927556A4E880D091770C67BEACE735890DE54093BD8DFFBFEDB773B2DCCF536C9D2432 AA66926A3E79782BA405EB886F584CD2D9DDABB776442103E9E725824AA7F6AF77C6875C356D3A5B32 11BB1304CA4F95D04238A7FB438EACF69B5A0DCA06548C4AECB6F026A9A9CD7AF2CFCEBCD4EBEA6E29 25750CB3005A015FB6753082010A0282010100CE39DEC3B9DD61546019BCA3781B87905A41F7407C46 A232683D7400B05CCCC1562359C75FAA4206E474A72FE09CFD941E46F98DDB0CE54831891C4D87EAE4 20E801E1808F44E2F2D47F36347ADC1DE40870880BDEF8DE39C5A34988E428F1418323F5AD0DD13EEC EA343FC4444E4AC72BA7C577D0E0276A0E8709B32BBC74F7ACC25B46DCDACED80394B993D8A37961D0 9219EB7A7A19F63AD0BD3646EC3BD06BCA1FDCCBEEE7C6F45EF302E904119B62AD20A0025BE39EF101 443E15B012F1653261F9595335E0D147AC7EA29D4003E475F94C454806B9215CFE6DD2E18DAB35DE61 6679C689587D3058A48F47776ACE67347CBB67EBC1A2D8984D968FA3410203010001727ED086BA52EE B1C02A228802F9D1A14B41544843

Targets

    • Target

      d2203b6d272d44b7abc66e290c3b79767428168b077a16ded1db0babbe34f333.exe

    • Size

      158KB

    • MD5

      3c4fa896e819cb8fada88a6fdd7b2cc7

    • SHA1

      0ebf10867534cb472bb98344f80e3a8aac0aa507

    • SHA256

      d2203b6d272d44b7abc66e290c3b79767428168b077a16ded1db0babbe34f333

    • SHA512

      e4486c33fc7bf99700fabec50ead10a6159758603d50eabe650436098a977b8c9dc728d0e8dbc3e3718393a7ba67cca8ea2799ef83e9194f178f04ae9784473e

    • SSDEEP

      3072:Wkb6bwPcmQ1mbTw8Gt189VTG079sTGyAzbnuvXdIR:WkTPcmscw/1ETGgWGy0uvC

    • Koxic

      A C++ written ransomware first seen in late 2021.

    • Modifies Windows Defender Real-time Protection settings

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Disables taskbar notifications via registry modification

    • Windows security modification

MITRE ATT&CK Enterprise v6

Tasks