blackcat | e160b6348f6fbdc444125bb65dbd94606d99da48c8334c8e6b2ee4429f813293

General

Target

encF.exe
Size

7.0MB
Sample

230207-y5zqeseh4v
MD5

8f2b7a45a93ee6f4806918aaa99c1b1b
SHA1

3a71e11a742a1ba1b7c088ce1377bd9eeb0f63f0
SHA256

e160b6348f6fbdc444125bb65dbd94606d99da48c8334c8e6b2ee4429f813293
SHA512

d436d66d97e689b9a05d8b4af1b75fc79ae8ba9880b6f3b9b731c5228f11ad77f621b6b802e29c9aec071f7a486989ea1c45349957b73d52ec1c0ddd6f7312d1
SSDEEP

98304:bAQQU9TWEdwOY7jhM28X5dq8Lk1BssJJmk3om1hV:bAQQU4Mw37jhUX5KAsJJmcoYL

Score

10^/10

Malware Config

Extracted

Path

C:\RECOVER-lgipe0y-FILES.txt

Ransom Note

>> What happened? Important files on your network was ENCRYPTED and now they have "lgipe0y" extension. In order to recover your files you need to follow instructions below. 2Tb of Sensitive data on your network was DOWNLOADED. If you DON'T WANT your sensitive data to be PUBLISHED you have to act quickly. The data stolen from you includes: - Personal information about the company's employees and customers - Armament supply chains to various sources - Blueprints and engineering documentation of the weapons - Information about who Solar Industries India is partnering with - Government documents revealing details of cooperation - Records from all production cameras and offices - Backups and databases - Details of warhead composition and engineering documentation of the callout elements of various products - Audits and reports of flaws and vulnerabilities in the company's products - Documentation of technical, power and other characteristics of the company's products - Internal product testing documentation with all documentation and approvals - Information and documents about our future developments - Contracts with the army and other customers Samples are available on your User Panel. >> CAUTION DO NOT MODIFY ENCRYPTED FILES YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. !!! You have 72 hours to contact us or your business will suffer the consequences described in your user panel !!! >> What should I do next? 1) Download and install Tor Browser from: https://torproject.org/ 2) Navigate to User Panel: http://qot4u7ma2l5mhao3y2xakn5esl6bd27fr6m7cpl6jllkxsdvehznmhyd.onion/?access-key=frP1iai0Cv18JS539FVCzllSv%2FwkW9XeDL2zVkQCEPziSdUJa2Eqd226xuN5rbEKr0y%2FYs6OuYczjN%2FT%2FoafqqycrkbeWX154nf5QXHrZjW%2FoRAxFqvxrO7fGWhWee2we6J3eWOMobELgIVG%2FHrhN5dXiKxc4mqTmKQdvyu1wtxSRYjXWUA50yhk%2F6r07osRsCDuqjiyXhdMzJkJKYDunIkEKNVW8auczEyyt5spdnsyce4VqCWXSf5N8MSRy8hUah9sh5R8NJt%2BkBOPjjI4Rtgd4TLa68h35Hnxbwzfw9zVsouHhuBBFbYne2PYqZugYcseDFkfkOmlnT1akqcWYA%3D%3D

URLs

http://qot4u7ma2l5mhao3y2xakn5esl6bd27fr6m7cpl6jllkxsdvehznmhyd.onion/?access-key=frP1iai0Cv18JS539FVCzllSv%2FwkW9XeDL2zVkQCEPziSdUJa2Eqd226xuN5rbEKr0y%2FYs6OuYczjN%2FT%2FoafqqycrkbeWX154nf5QXHrZjW%2FoRAxFqvxrO7fGWhWee2we6J3eWOMobELgIVG%2FHrhN5dXiKxc4mqTmKQdvyu1wtxSRYjXWUA50yhk%2F6r07osRsCDuqjiyXhdMzJkJKYDunIkEKNVW8auczEyyt5spdnsyce4VqCWXSf5N8MSRy8hUah9sh5R8NJt%2BkBOPjjI4Rtgd4TLa68h35Hnxbwzfw9zVsouHhuBBFbYne2PYqZugYcseDFkfkOmlnT1akqcWYA%3D%3D

Targets

- Target
  
  encF.exe
- Size
  
  7.0MB
- MD5
  
  8f2b7a45a93ee6f4806918aaa99c1b1b
- SHA1
  
  3a71e11a742a1ba1b7c088ce1377bd9eeb0f63f0
- SHA256
  
  e160b6348f6fbdc444125bb65dbd94606d99da48c8334c8e6b2ee4429f813293
- SHA512
  
  d436d66d97e689b9a05d8b4af1b75fc79ae8ba9880b6f3b9b731c5228f11ad77f621b6b802e29c9aec071f7a486989ea1c45349957b73d52ec1c0ddd6f7312d1
- SSDEEP
  
  98304:bAQQU9TWEdwOY7jhM28X5dq8Lk1BssJJmk3om1hV:bAQQU4Mw37jhUX5KAsJJmcoYL
Score

10^/10

evasion ransomware spyware stealer
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Clears Windows event logs
  evasion ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2