Resubmissions

24-01-2023 13:50

230124-q5b1csca58 10

24-01-2023 13:46

230124-q2y1qaca48 10

24-11-2022 17:20

221124-vwk9wscd91 10

General

  • Target

    f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.zip

  • Size

    1.3MB

  • Sample

    221124-vwk9wscd91

  • MD5

    846274ff97d7e0bffcc993cab1851270

  • SHA1

    f5eac094d9eb8f1f691d66d1cfc1a9ada6548def

  • SHA256

    383eb4802490f4ffd47f7918d5cd237e69deed15f0ce2aba761f7120d7481037

  • SHA512

    861e4ad17b9f1ab53a94bf785b436bf3336218c1d5a9dcb41047b5ea8d7de549032727c4896b86e3ab8c7cdd410208e8999505a24dd09e9b2b75db7a4b13a3fa

  • SSDEEP

    24576:0yng4r50RMb/FuiExo7BOKoEfgPWy6wAxvXwgdqTYRpYeTDAeBu6QRaPm0LjeZFd:jg4rsMsVsHoEsW3dXwYAYrYeDz06zu0k

Score
10/10

Malware Config

Extracted

Path

C:\README.TXT

Family

royal

Ransom Note
Hello! If you are reading this, it means that your system were hit by Royal ransomware. Please contact us via : http://royal2xthig3ou5hd7zsliqagy6yygk2cdelaxtni2fyad6dpmpxedid.onion/12344567890987654321234567890987 In the meantime, let us explain this case.It may seem complicated, but it is not! Most likely what happened was that you decided to save some money on your security infrastructure. Alas, as a result your critical data was not only encrypted but also copied from your systems on a secure server. From there it can be published online.Then anyone on the internet from darknet criminals, ACLU journalists, Chinese government(different names for the same thing), and even your employees will be able to see your internal documentation: personal data, HR reviews, internal lawsuitsand complains, financial reports, accounting, intellectual property, and more! Fortunately we got you covered! Royal offers you a unique deal.For a modest royalty(got it; got it ? ) for our pentesting services we will not only provide you with an amazing risk mitigation service, covering you from reputational, legal, financial, regulatory, and insurance risks, but will also provide you with a security review for your systems. To put it simply, your files will be decrypted, your data restoredand kept confidential, and your systems will remain secure. Try Royal today and enter the new era of data security! We are looking to hearing from you soon!
URLs

http://royal2xthig3ou5hd7zsliqagy6yygk2cdelaxtni2fyad6dpmpxedid.onion/12344567890987654321234567890987

Targets

    • Target

      f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429.exe

    • Size

      2.9MB

    • MD5

      df0b88dafe7a65295f99e69a67db9e1b

    • SHA1

      db3163a09eb33ff4370ad162a05f4b2584a20456

    • SHA256

      f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429

    • SHA512

      2206969d222882dd8b7e3e5671311462266277d699e08e3016a7b3781b17390e8dd11956d8aaecae996a2c16227d7b2390eb84b9b8df26e39ffe8f38d5b76fbd

    • SSDEEP

      49152:cDVwASOLGtlqrRIU6i9+vazNqQlJZP1BMU2thA8mNtNCiJlrRUFcJ7HIPcLzkw5c:wm+GaNqqJJ12vlZol8cJ7rc3

    Score
    10/10
    • Royal

      Royal is a ransomware first seen in 2022.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops startup file

    • Drops desktop.ini file(s)

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

File Deletion

2
T1107

Impact

Inhibit System Recovery

2
T1490

Tasks