Overview

overview

10

Static

static

10

FW-APGKSDT...DF.exe

windows7-x64

10

FW-APGKSDT...DF.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    fw-apgksdtpx4hoaujjmbvdnxpohz.pdf.zip

  • Size

    559KB

  • Sample

    230215-yrzhhadd9v

  • MD5

    9974aa230d73ba761c76ea05f478a65b

  • SHA1

    8b131fbe7b84e149b379e634a7fb755262825552

  • SHA256

    aab1afbc7706030c1b710c6ae0873fd22de1190604301d0df17e1acae972ef7c

  • SHA512

    1db837b47516d39bf3cb5e25230d29ecf4643b6d78edc628107cc14a4cf2a232710125db78340ac94c85751f489cf2ef0007553b2a7ffba1687da1f15bddd037

  • SSDEEP

    12288:kA6nKHdJ8iyP9pjSGSXdSJpwAfOIK/el+8ZfwEwFAzWMbn1ONDt9ZUGy:kZK9VXc4AfOIK/eZBwFT21ONDtm

Score
10/10
xoristpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-999675638-2867687379-27515722-1000\HOW TO DECRYPT FILES.txt

Ransom Note
YOUR SYSTEM IS LOCKED AND ALL YOUR IMPORTANT DATA HAS BEEN ENCRYPTED. DON'T WORRY YOUR FILES ARE SAFE. TO RETURN ALL THE NORMALLY YOU MUST BUY THE CERBER DECRYPTOR PROGRAM. PAYMENTS ARE ACCEPTED ONLY THROUGH THE BITCOIN NETWORK. YOU CAN GET THEM VIA ATM MACHINE OR ONLINE https://coinatmradar.com/ (find a ATM) https://www.localbitcoins.com/ (buy instantly online any country) 1. Visit qtox.github.io 2. Download and install qTOX on your PC. 3. Open it, click "New Profile" and create profile. 4. Click "Add friends" button and search our contact - DA639EF141F3E3C35EA62FF284200C29FA2E7E597EF150FDD526F9891CED372CBB9AB7B8BEC8 For more information : [email protected] (24/7) Second Support Via Email Subject : SYSTEM-LOCKED-ID: MortalKombat=ID12DJ901S
URLs

https://coinatmradar.com/

https://www.localbitcoins.com/

Targets

    • Target

      FW-APGKSDTPX4HOAUJJMBVDNXPOHZ.PDF.exe

    • Size

      577KB

    • MD5

      8b42ebfba0cb67a1164a15c6dae6fbef

    • SHA1

      5d4b97bbf2ca874b5924ec489c90a2e109ae2ad6

    • SHA256

      e5f60df786e9da9850b7f01480ebffced3be396618c230fa94b5cbc846723553

    • SHA512

      cb3be528482a3304217d7ab805b46a76a597b3cdfd4a000aaf4642039bd91064ea579ee3fae64ff4a568d7c9cb7f1d3be0adbd196f9c8cc01d89152bbbd2de4e

    • SSDEEP

      12288:cqt10g6PdfHXIMgWw+PgOoC0c2L10oP9X:cqt1p6ZHXWb+PDm0w

    Score
    10/10
    persistenceransomwarespywarestealer

    • Drops file in Drivers directory

    • Modifies Installed Components in the registry

      persistence

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks