General
-
Target
b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649
-
Size
719KB
-
Sample
221116-gb7qhadc2y
-
MD5
8474039d83805eb7b447325c3a8d1ebb
-
SHA1
a07d537f4253745a087709a9a07c449f84deed8d
-
SHA256
b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649
-
SHA512
3272091bbf123ba5e1592e8b2bd7740cddcb174fa158bc6980b25ee61d92387e94a25284736253f83a6eea78b427f6717e888e843db9d7759cfe9a7676576438
-
SSDEEP
12288:q4UOTYQivI2qZ7aSgLwkFVpzUvest4ZEbjJLuhJVoM7SPd:bRTYVQ2qZ7aSgLwuVfstRJL6YM6
Score
10/10
Malware Config
Extracted
Path
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Recovery_Instructions.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">F4994027DBD86A60C54E929BDE291CF1522E6AF000D03717066898BEDD3F59019250E872805A3456C2CB16166CC9298A226BEC58A036454627D8D982F4370BAC<br>2A4E0372570B32FD106BB7C4367BE06508DABF2B7596846FB43B25C6E35E5FB4ECFE5BA8AB67FC60A23E741C1A24631D4E331D041A3B060280CF50B53BA1<br>DFA6AB4B792DFAAC2C1A4081B19779FD0C58D976BF78741480C6CB09391DCD183E314DAB44E0B704134921A5B580987F2AEFDAF7A3908D84CD85795DF1AB<br>98ADF8F2B382F29BA67FF80EF098770EB98ECDBC9BC2CDB3D32FEF4B2A3D9A3298E1EC70809BF66BF79A7FDC91F285CFCCF19D93FBFE1CE4E2820C2637B8<br>11AE84353DBF438D0ED9015E962DE1DA627CA0B9449B654A1B9E91A92878E607CE99FFACD13B6088F46E92CCD440523331DC778DAC31FBB9127E70AA9C09<br>4E3DB0A492F3CBF0E159EF2749A2A22354BEE28E4E37B0F1330F3BC61A6B0F52F2C9B32FCA79C6F1AD1B620B79DDDBDA6ECA87A86AAC5F6D6B5B97EBC685<br>927D179B4CA6992A4FE95ACB977C9C08A87063873B66F002BA6C97C56E129687672AAE4DE8AFE5526A985D1709FD99F69F19E1DD3F77F78A4E03F162F39C<br>6EDF9468ED0F1080FA941C3F00C9536DAE63FEC219810573A56656A750EC13C9BE9DB7332CFDDE73AF1CA4EA3F82C368BD6D0EC792C2F424A10EDEF9973F<br>69A08E6B8369B50A8C72C47F6A88</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>http://gvlay6u4g53rxdi5.onion/31-LPy3hdSfGLBgLSfGcKN9rubDKoa1VMK4-jYy07h0aZDffbnIWODKSuovhy1PH34nH</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br>
4. Start a chat and follow the further instructions. <br><br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected]">[email protected]</a>
<br><a href="[email protected]">[email protected]</a>
<br>
<b>* To contact us, create a new mail on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr>
<b>Make contact as soon as possible. Your private key (decryption key) <br>
is only stored temporarily.<br><br>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
href="[email protected]">[email protected]</a>
href="[email protected]">[email protected]</a>
Extracted
Path
C:\Recovery_Instructions.html
Ransom Note
<html>
<style type="text/css">
body {
background-color: #f5f5f5;
}
h1, h3{
text-align: center;
text-transform: uppercase;
font-weight: normal;
}
/*---*/
.tabs1{
display: block;
margin: auto;
}
.tabs1 .head{
text-align: center;
float: top;
padding: 0px;
text-transform: uppercase;
font-weight: normal;
display: block;
background: #81bef7;
color: #DF0101;
font-size: 30px;
}
.tabs1 .identi {
font-size: 10px;
text-align: center;
float: top;
padding: 15px;
display: block;
background: #81bef7;
color: #DFDFDF;
}
.tabs .content {
background: #f5f5f5;
/*text-align: center;*/
color: #000000;
padding: 25px 15px;
font-size: 15px;
font-weight: 400;
line-height: 20px; }
.tabs .content a {
color: #df0130;
font-size: 23px;
font-style: italic;
text-decoration: none;
line-height: 35px; }
.tabs .content .text{
padding: 25px;
line-height: 1.2;
}
</style>
<body>
<div class="tabs1">
<div class="head" ><b>Your personal ID:</b></div>
<div class="identi">
<span style="width:1000px; color: #ffffff; font-size: 10px;">98AE37E52170B225929C2D51059174C17134A51DF591529BEA8F3AA070C261FF0AA03FBF1C3519AC9A69EB70A99569B30D38773DE924449867C4F108FC1D7841<br>DB7C01DDEEFE87EBAF7D938BFB6807809B1A6283329345F7237F119FC6BDC9B8D5CDEBCED196885E791EDC0E493AB90BD5889052ED83DB009C840060B83C<br>1FAF936D04AC476B93DFA681F774DD1815DDD0A19118E33F58AC7F4FA30073CE41AD299AA1E65116D35B8DF49D968145060124A07FF4A7E1AF8DDF1CBE12<br>DC0AA684ECC213B96EFFADCAE9064D71D9599D27B1107D6C224372C8203E31682E9D6BCD15B294646EF6ED70B9494A0C07045BF4ADF6FA398424FC0F6A35<br>6844D1DB1292C5B103CF9E32BA5868D13788FFA8C8A8519AAFE437BF1ED9502A4C91AF007D582B20FE959C89639D29D40D80A439B6F21B8647D54192C3B2<br>50CD9964BA582ACE8A2991FD38DEA4F749F242EC0718FBB0DF75299F4061C5BDB542B2C75800E5FD72EDE8F7A63036FEF42AC6D22A822B939807A3BD8475<br>B99ACF8C1A52975A8EE967F8604CE306B79FA4B29534D3ECBE73B58C26370F4A9D1637049B033DCBDD7BC538BFBC38E70B7898DD5D57E9EFDA4D6AB1FF96<br>52847D126F9125DB59C7308233389723277D6E021C69C6701551057263E7C41979BB51F613066568F9FD3DE9BB376827FF2B14C02EBEF2E2ED98B014C64C<br>B3F5E5E2E5C394C1EEA4E09B3905</span> <br>
<!-- !!! dont changing this !!! -->
</div>
</div>
<!-- -->
<div class="tabs">
<!--tab-->
<div class="tab">
<div id="tab-content1" class="content">
<div class="text">
<!--text data -->
<b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br>
<b>All your important files have been encrypted!</b><br><br>
<hr>
Your files are safe! Only modified. (RSA+AES)<br><br>
ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br>
WILL PERMANENTLY CORRUPT IT.<br>
DO NOT MODIFY ENCRYPTED FILES.<br>
DO NOT RENAME ENCRYPTED FILES.<br><br>
No software available on internet can help you. We are the only ones able to<br>
solve your problem.<br><br>
We gathered highly confidential/personal data. These data are currently stored on<br>
a private server. This server will be immediately destroyed after your payment.<br>
If you decide to not pay, we will release your data to public or re-seller.<br>
So you can expect your data to be publicly available in the near future..<br><br>
We only seek money and our goal is not to damage your reputation or prevent<br>
your business from running.<br><br>
You will can send us 2-3 non-important files and we will decrypt it for free<br>
to prove we are able to give your files back.<br><br>
<!--text data -->
<hr>
<b>Contact us for price and get decryption software.</b><br><br>
<a>http://gvlay6u4g53rxdi5.onion/31-LPy3hdSfGLBgLSfGcKN9rubDKoa1VMK4-H3dYJG3sUgQseP5kApShllTH1OLJgml4</a><br>
* Note that this server is available via Tor browser only<br><br>
Follow the instructions to open the link:<br>
1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br>
2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br>
3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br>
4. Start a chat and follow the further instructions. <br><br>
<hr>
<b>If you can not use the above link, use the email:</b><br>
<a href="[email protected]">[email protected]</a>
<br><a href="[email protected]">[email protected]</a>
<br>
<b>* To contact us, create a new mail on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr>
<b>Make contact as soon as possible. Your private key (decryption key) <br>
is only stored temporarily.<br><br>
IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br>
</div>
</div>
</div>
<!--tab-->
<!--text data -->
</div>
</div>
<!--tab-->
</div>
</div>
</body>
</html>
Emails
href="[email protected]">[email protected]</a>
href="[email protected]">[email protected]</a>
Targets
-
-
Target
b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649
-
Size
719KB
-
MD5
8474039d83805eb7b447325c3a8d1ebb
-
SHA1
a07d537f4253745a087709a9a07c449f84deed8d
-
SHA256
b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649
-
SHA512
3272091bbf123ba5e1592e8b2bd7740cddcb174fa158bc6980b25ee61d92387e94a25284736253f83a6eea78b427f6717e888e843db9d7759cfe9a7676576438
-
SSDEEP
12288:q4UOTYQivI2qZ7aSgLwkFVpzUvest4ZEbjJLuhJVoM7SPd:bRTYVQ2qZ7aSgLwuVfstRJL6YM6
Score10/10-
Detect Neshta payload
-
MedusaLocker
Ransomware with several variants first seen in September 2019.
-
MedusaLocker payload
-
Modifies system executable filetype association
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
UAC bypass
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-