Overview

overview

10

Static

static

a-Skjkmfvbkv.bin.exe

windows7-x64

10

a-Skjkmfvbkv.bin.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a-Skjkmfvbkv.bin.exe

  • Size

    12KB

  • Sample

    221129-wx6gwsdc78

  • MD5

    8383ef681ba9f25dd7bf49c28cef559e

  • SHA1

    12ddeb7c5e504dfbbf194842feb86662c170a8f1

  • SHA256

    193d2c92560adcc08eaf3157673b1f835ae85c5c74679cac587e753f67b33dcf

  • SHA512

    6ef606af88c235f21868f3e9d8ade4e3eb76308559f54ee2501b6302031bc635d68edd0a23de65a7e7590264827fdff1a4ac7e95d5327bc10fb4839397380af4

  • SSDEEP

    384:pUR3OFfFLM89kDKyfjDWwYWxptYcFmVc03K:OOFhv9k28ttYcFmVc6K

Score
10/10
discoveryevasionpersistenceransomware

Malware Config

Extracted

Path

C:\FILE RECOVERY.txt

Ransom Note
Hello Your files are encrypted and can not be used To return your files in work condition you need decryption tool Follow the instructions to decrypt all your data Do not try to change or restore files yourself, this will break them If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB How to get decryption tool: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: BDB6543C183BBABD9663DEFA 5) You will see payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion If you are unable to contact us through the site, then you can email us: mallox.resurrection@onionmail.org Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site.�
Emails

mallox.resurrection@onionmail.org

URLs

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Targets

    • Target

      a-Skjkmfvbkv.bin.exe

    • Size

      12KB

    • MD5

      8383ef681ba9f25dd7bf49c28cef559e

    • SHA1

      12ddeb7c5e504dfbbf194842feb86662c170a8f1

    • SHA256

      193d2c92560adcc08eaf3157673b1f835ae85c5c74679cac587e753f67b33dcf

    • SHA512

      6ef606af88c235f21868f3e9d8ade4e3eb76308559f54ee2501b6302031bc635d68edd0a23de65a7e7590264827fdff1a4ac7e95d5327bc10fb4839397380af4

    • SSDEEP

      384:pUR3OFfFLM89kDKyfjDWwYWxptYcFmVc03K:OOFhv9k28ttYcFmVc6K

    Score
    10/10
    discoveryevasionpersistenceransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Stops running service(s)

      evasion

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

File Deletion

2
T1107

Impair Defenses

1
T1562

File Permissions Modification

1
T1222

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Service Stop

1
T1489

Tasks