Overview

overview

10

Static

static

10

0c6f444c69...79.exe

windows7-x64

10

0c6f444c69...79.exe

windows10-2004-x64

10

13828b390d...31.exe

windows7-x64

1

13828b390d...31.exe

windows10-2004-x64

1

15b57c1b68...ed.exe

windows7-x64

1

15b57c1b68...ed.exe

windows10-2004-x64

1

1af1ca666e...8e.exe

windows7-x64

1

1af1ca666e...8e.exe

windows10-2004-x64

1

28d7e6fe31...69.exe

windows7-x64

1

28d7e6fe31...69.exe

windows10-2004-x64

1

2cf54942e8...fc.exe

windows7-x64

10

2cf54942e8...fc.exe

windows10-2004-x64

10

38834b796e...d1.exe

windows7-x64

1

38834b796e...d1.exe

windows10-2004-x64

1

3d7cf20ca6...83.exe

windows7-x64

1

3d7cf20ca6...83.exe

windows10-2004-x64

1

4e18f9293a...bf.exe

windows7-x64

1

4e18f9293a...bf.exe

windows10-2004-x64

1

59868f4b34...3f.exe

windows7-x64

1

59868f4b34...3f.exe

windows10-2004-x64

1

731adcf2d7...61.exe

windows7-x64

1

731adcf2d7...61.exe

windows10-2004-x64

1

7b2449bb8b...87.exe

windows7-x64

1

7b2449bb8b...87.exe

windows10-2004-x64

1

7e363b5f1b...8e.exe

windows7-x64

1

7e363b5f1b...8e.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8532047982.zip

  • Size

    20.6MB

  • Sample

    221202-e2agksgd91

  • MD5

    3e52a1ec6462ec78ca39a22af21a7f28

  • SHA1

    bac0a8d5199c70b27888eb12e501697a4d268b8f

  • SHA256

    e7f9950b9bd3b858b72430df9ec0f7c0cc349570fb848ec2cf9da4dc139160b6

  • SHA512

    da00487fd4f707349f9ae1903a1ea6415ffcf21668c894f2686e104bef65b8bd756a7dd8ace5376d83fe19a87ad63c84fa288b0745667f35b29460df61064260

  • SSDEEP

    393216:koQCM1CsSGTYS4VruUOUPs1bKxdKkbNBdwjGNt4uz//sOS/wlh7GhihjpMI:HM1lY3KUyKPKkbFt/zsOiwlhYihjpn

Score
10/10
blackcatransomware

Malware Config

Extracted

Family

blackcat

Credentials
  • Username:
    KELLERSUPPLY\Administrator
  • Password:
    d@gw00d
  • Username:
    KELLERSUPPLY\AdminRecovery
  • Password:
    K3ller!$Supp1y
  • Username:
    .\Administrator
  • Password:
    d@gw00d
  • Username:
    .\Administrator
  • Password:
    K3ller!$Supp1y
Attributes
  • enable_network_discovery

    true

  • enable_self_propagation

    false

  • enable_set_wallpaper

    true

  • extension

    sykffle

  • note_file_name

    RECOVER-${EXTENSION}-FILES.txt

  • note_full_text

    >> Introduction Important files on your system was ENCRYPTED and now they have have "${EXTENSION}" extension. In order to recover your files you need to follow instructions below. >> Sensitive Data Sensitive data on your system was DOWNLOADED and it will be PUBLISHED if you refuse to cooperate. Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... Private preview is published here: http://zujgzbu5y64xbmvc42addp4lxkoosb4tslf5mehnh7pvqjpwxn5gokyd.onion/b21e1fb6-ff88-425b-8339-3523179a1e3e/886cf430a907bbe9a3fd38fb704d524dbd199c1b042ad6f65dc72ad78704e21 >> CAUTION DO NOT MODIFY FILES YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. YOUR DATA IS STRONGLY ENCRYPTED, YOU CAN NOT DECRYPT IT WITHOUT CIPHER KEY. >> Recovery procedure Follow these simple steps to get in touch and recover your data: 1) Download and install Tor Browser from: https://torproject.org/ 2) Navigate to: http://mu75ltv3lxd24dbyu6gtvmnwybecigs5auki7fces437xvvflzva2nqd.onion/?access-key=${ACCESS_KEY}

rsa_pubkey.plain
rsa_pubkey.plain
rsa_pubkey.plain
rsa_pubkey.plain
rsa_pubkey.plain
rsa_pubkey.plain
rsa_pubkey.plain
rsa_pubkey.plain
rsa_pubkey.plain

Targets

    • Target

      0c6f444c6940a3688ffc6f8b9d5774c032e3551ebbccb64e4280ae7fc1fac479

    • Size

      2.6MB

    • MD5

      bb266486ee8ac70c0687989e02cefa14

    • SHA1

      11203786b17bb3873d46acae32a898c8dac09850

    • SHA256

      0c6f444c6940a3688ffc6f8b9d5774c032e3551ebbccb64e4280ae7fc1fac479

    • SHA512

      a167779fc95a5cf0a3eff86211e9e08c282470e050b17ae62c7499a82ea59b3447446eafea9d7b5c5ba833b7a2d060f76530b00509dd5ff7904a0735d83e14c4

    • SSDEEP

      49152:rEqvaaAjc2hdKjb8WXqE1PiEbE/TKMt3/RgaJ2wW4PRT8O1:rbyaALKjwWXV1P9oVvwwW4JT8

    Score
    10/10
    blackcatransomware
    behavioral1behavioral2

    • Target

      13828b390d5f58b002e808c2c4f02fdd920e236cc8015480fa33b6c1a9300e31

    • Size

      2.9MB

    • MD5

      c6901bc6720e1e30c6c2e89aae874a90

    • SHA1

      783b2b053ef0345710cd2487e5184f29116e367c

    • SHA256

      13828b390d5f58b002e808c2c4f02fdd920e236cc8015480fa33b6c1a9300e31

    • SHA512

      64647585b838fa91c545219350b58609f90fa4817bd8848e4af0b71c98e6d340dc011abe405ce6f044cb5a99acfacdc8bd212ea7289b002ab8285aa42e9008fb

    • SSDEEP

      49152:4dwE1vCCeShiBHJFIPiEPE3bvk6Ca89388YhwjfJNu/RgaJ2wtb:WwE1253IPiYE3bnCa8HzjOvwwtb

    Score
    1/10
    behavioral3behavioral4

    • Target

      15b57c1b68cd6ce3c161042e0f3be9f32d78151fe95461eedc59a79fc222c7ed

    • Size

      2.9MB

    • MD5

      c1dd3d5a3528bf56632200d247ca9774

    • SHA1

      89060eff6db13e7455fee151205e972260e9522a

    • SHA256

      15b57c1b68cd6ce3c161042e0f3be9f32d78151fe95461eedc59a79fc222c7ed

    • SHA512

      21de78d7077f536211a32fb4596c91f8ded01ffb9a33e3637a0fde466bde6d078ca0d1ddae36c89e74ed7bd87c0758959936619a2eeab59284b0c15c42f3bc9c

    • SSDEEP

      49152:4dwE1vCCeShiBHJFIPiEPE3bvk6Ca89388YhwjfJNM/RgaJ2wtb:WwE1253IPiYE3bnCa8HzjQvwwtb

    Score
    1/10
    behavioral5behavioral6

    • Target

      1af1ca666e48afc933e2eda0ae1d6e88ebd23d27c54fd1d882161fd8c70b678e

    • Size

      2.9MB

    • MD5

      51826408514057db47c0bbbffb2c581d

    • SHA1

      ce5540c0d2c54489737f3fefdbf72c889ac533a9

    • SHA256

      1af1ca666e48afc933e2eda0ae1d6e88ebd23d27c54fd1d882161fd8c70b678e

    • SHA512

      43f4cab0a8ff4c3ea8eb3705f5e35028faf27dcb76b7d22e5a87b16f9690ba56710d39ee6e613e6acb682a924fdb705ca34a14e401609de978b83aaecb354251

    • SSDEEP

      49152:VUzeOdI+NDXIgqUPGPiTgvRZHrn7hQyZ9haNSAXpuNh/RgaJ2wf3:VUzekDpRGaTARZHPhQMCcyYvwwf3

    Score
    1/10
    behavioral7behavioral8

    • Target

      28d7e6fe31dc00f82cb032ba29aad6429837ba5efb83c2ce4d31d565896e1169

    • Size

      2.9MB

    • MD5

      0b6ef1e650df35e2d04c56ebfcceabc7

    • SHA1

      5c6ca5581a04955d8e4d1fa452621fbc922ecb7b

    • SHA256

      28d7e6fe31dc00f82cb032ba29aad6429837ba5efb83c2ce4d31d565896e1169

    • SHA512

      3533d35da9ac8956c6c76611747ff153fee5281ee6ea3a67c6a04e833433afefcb592568b8adf8d402ae531ecce2a90adc5a46eff5e5093bfdb03a7956a8e13c

    • SSDEEP

      49152:YYLYnf7oHlXOIHXRruh2EYAtfheziI9Rlq+QaXTNZ/RgaJ2wM/:LqDoHA2XR6hpYAtwziIJAaLvwwM/

    Score
    1/10
    behavioral10behavioral9

    • Target

      2cf54942e8cf0ef6296deaa7975618dadff0c32535295d3f0d5f577552229ffc

    • Size

      2.6MB

    • MD5

      ed075c4718fd98efcbc845db00677065

    • SHA1

      f466b4d686d1fa9fed064507639b9306b0d80bbf

    • SHA256

      2cf54942e8cf0ef6296deaa7975618dadff0c32535295d3f0d5f577552229ffc

    • SHA512

      e183ad2ee95d9e94dcfff99f93e01077422db0c7b01a2ba4b6d830bf5ef0f1c400aae67617ebcce32bb25537786781d13458a0abea7efba6bb9062cafa39cc8c

    • SSDEEP

      49152:JEqvaaAjc2hdKjb8WXqE1PiEbE/TKMt3/RgaJ2wWYzme6IN/VmAv:JbyaALKjwWXV1P9oVvwwWYCe7VmO

    Score
    10/10
    blackcatransomware
    behavioral11behavioral12

    • Target

      38834b796ed025563774167716a477e9217d45e47def20facb027325f2a790d1

    • Size

      2.9MB

    • MD5

      9c54d3b2a64d92bca577a12b70d8d29a

    • SHA1

      da1e4a09a59565c5d62887e0e9a9f6f04a18b5f4

    • SHA256

      38834b796ed025563774167716a477e9217d45e47def20facb027325f2a790d1

    • SHA512

      1e2a77e450e35a837c0c96058473903b9f522d89933def308abbed105a895848c1766f3db01cdb708cd99d93b79fc6f7882675ef782602e851edebae732237a7

    • SSDEEP

      49152:gcqhaNi3HoskIGwwjbQycBXDurrX+odANg/RgaJ2w9nO:gcqhKi3HoskxwwjbUBXDAOozvww9nO

    Score
    1/10
    behavioral13behavioral14

    • Target

      3d7cf20ca6476e14e0a026f9bdd8ff1f26995cdc5854c3adb41a6135ef11ba83

    • Size

      2.2MB

    • MD5

      aea5d3cced6725f37e2c3797735e6467

    • SHA1

      087497940a41d96e4e907b6dc92f75f4a38d861a

    • SHA256

      3d7cf20ca6476e14e0a026f9bdd8ff1f26995cdc5854c3adb41a6135ef11ba83

    • SHA512

      5489753ae1c3ba0dbd3e0ce1b78b0ccba045e534e77fb87c80d56b16229f928c46a15721020142bbc6bd4d1ba5c295f4bec3596efa7b46c906889c156dadbd66

    • SSDEEP

      49152:BEqvaaAjc2hdKjb8WXqE1PiEbE/TKMt3/RgaJ2wW:BbyaALKjwWXV1P9oVvwwW

    Score
    1/10
    behavioral15behavioral16

    • Target

      4e18f9293a6a72d5d42dad179b532407f45663098f959ea552ae43dbb9725cbf

    • Size

      2.9MB

    • MD5

      70b8bc74f381c9d7d1016006c3950f85

    • SHA1

      655c2567650d2c109fab443de4b737294994f1fd

    • SHA256

      4e18f9293a6a72d5d42dad179b532407f45663098f959ea552ae43dbb9725cbf

    • SHA512

      7ec1df31297f4458adf1a4245fa6a902919a144758d2da9187e25472e53f8db7047a8a7487fdaa5d466f3b2dd2edbbe8e2daca3d9b36ff70608af5a8acf47ef3

    • SSDEEP

      49152:4dwE1vCCeShiBHJFIPiEPE3bvk6Ca89388YhwjfJNH/RgaJ2wtb:WwE1253IPiYE3bnCa8Hzj/vwwtb

    Score
    1/10
    behavioral17behavioral18

    • Target

      59868f4b346bd401e067380cac69080709c86e06fae219bfb5bc17605a71ab3f

    • Size

      2.9MB

    • MD5

      fe16fa500584cb241532dc7cb75c1f53

    • SHA1

      e22436386688b5abe6780a462fd07cd12c3f3321

    • SHA256

      59868f4b346bd401e067380cac69080709c86e06fae219bfb5bc17605a71ab3f

    • SHA512

      1240d7af8842ef9c2afb07b5026525f2e1c8230a53bdcef64b4a3c838cbaf32bc742aab56fda133347a5a565a632891ba8fe9c3ac7056ee139825a5fb99a1346

    • SSDEEP

      49152:rAnCsMZjVpVbl4D5GzNMFsl4UROAUc1y32ZxJFi4NS/RgaJ2w1M:rAnCs8pVblGyNM+l4UxUc1BhFovww1M

    Score
    1/10
    behavioral19behavioral20

    • Target

      731adcf2d7fb61a8335e23dbee2436249e5d5753977ec465754c6b699e9bf161

    • Size

      2.9MB

    • MD5

      173c4085c23080d9fb19280cc507d28d

    • SHA1

      a186c08d3d10885ebb129b1a0d8ea0da056fc362

    • SHA256

      731adcf2d7fb61a8335e23dbee2436249e5d5753977ec465754c6b699e9bf161

    • SHA512

      626c4dbc60988566446e2e59840953cb53ec9ad64914ab2758519941f60aa27db9ff574a188cf32039690f1f34a6834f8c3804f2aa1f89b409d9a98c07ea8267

    • SSDEEP

      49152:rAnCsMZjVpVbl4D5GzNMFsl4UROAUc1y32ZxJFi4N1/RgaJ2w1M:rAnCs8pVblGyNM+l4UxUc1BhFDvww1M

    Score
    1/10
    behavioral21behavioral22

    • Target

      7b2449bb8be1b37a9d580c2592a67a759a3116fe640041d0f36dc93ca3db4487

    • Size

      2.9MB

    • MD5

      81d7c2d1dca5da7eef2896a76768d142

    • SHA1

      57a6dfd2b021e5a4d4fe34a61bf3242ecee841b3

    • SHA256

      7b2449bb8be1b37a9d580c2592a67a759a3116fe640041d0f36dc93ca3db4487

    • SHA512

      ebfa5d0b8d120614f608f01ed26256d7427cc38e7c901866421966b01b04554153780ceb726c3b250e7ba6a589c553cf51e67713e75d661ce07dd3760cc752c7

    • SSDEEP

      49152:gcqhaNi3HoskIGwwjbQycBXDurrX+odANA/RgaJ2w9nO:gcqhKi3HoskxwwjbUBXDAOoDvww9nO

    Score
    1/10
    behavioral23behavioral24

    • Target

      7e363b5f1ba373782261713fa99e8bbc35ddda97e48799c4eb28f17989da8d8e

    • Size

      2.9MB

    • MD5

      8e1f22dd9e809ead5e19b340b0c80cae

    • SHA1

      2a53525eeb7b76b3d1bfe40ac349446f2add8784

    • SHA256

      7e363b5f1ba373782261713fa99e8bbc35ddda97e48799c4eb28f17989da8d8e

    • SHA512

      be15ca5203ea0a5ea8ac6459b9d47d74f36e5830a1545faf5b7e9697afa377c7cf7a1cc57358c62d35f5f67c03d71fbbaff25c6994c42ef08c469981e74b118b

    • SSDEEP

      49152:2nvp+Zzw4dyY450JZRg/3a4aYstmTUVciEeNq/RgaJ2wQc:2nB+pLdoQz43a4PcGiIvwwQc

    Score
    1/10
    behavioral25behavioral26

MITRE ATT&CK Matrix

Tasks