General

  • Target

    Q7B3RC.bin.exe

  • Size

    229KB

  • Sample

    230311-vgtygsae75

  • MD5

    2979ed84c4ca3deb2924bd1f26bf88bd

  • SHA1

    8f01f9112904389e0b53a25506ef69f99cc0fa1b

  • SHA256

    bcf49e8f493c9eff83d9bc891e91dc91777f02b4f176e44b20f9a2d651f20fc3

  • SHA512

    bd0088d587357851da5e4a7bd9cb1034c404cd5db9a12b9b27efa68a8a28b250d4a2c7346eff0cd14955713cbc13698a6c646d0d573602ccc0f7bda3d0c2d37f

  • SSDEEP

    6144:oNxyvPouZtK58suC/004GKXkq4RUs3fyW:oNxyXNtK58su3Z0RPj

Malware Config

Extracted

Path

\Device\HarddiskVolume1\Boot\da-DK\!!!HOW_TO_DECRYPT!!!.txt

Ransom Note
Your network has been infected ! We have you corporate data. Thousands of all your client cases with all personal information, evidences, e-mails, addresses, SSNs, financial information, accounting, Outlook PST archives of your attorneys and staff. Really we have almost mirror of your servers in our network. ============================================================================================================================ The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. ============================================================================================================================= If no payment will be arranged or you will ignore negotiations: - we will start randomly notify some of you active 2021 clients about incident sending them link on their private data. - we well resell data on dark-web marketplaces, cause there is a thousands of personal confidential records - we will post data on few top data-leaks resources, well-known among journalists ============================================================================================================================== You can contact us by downloading and installing TOX chat (https://tox.chat/download.html) Support TOX ID: F0EC47657B9144F5161C7E343BA85401C43826CA0907309FF67513538B0ACD585A07D4A979DC
URLs

https://tox.chat/download.html

Targets

    • Target

      Q7B3RC.bin.exe

    • Size

      229KB

    • MD5

      2979ed84c4ca3deb2924bd1f26bf88bd

    • SHA1

      8f01f9112904389e0b53a25506ef69f99cc0fa1b

    • SHA256

      bcf49e8f493c9eff83d9bc891e91dc91777f02b4f176e44b20f9a2d651f20fc3

    • SHA512

      bd0088d587357851da5e4a7bd9cb1034c404cd5db9a12b9b27efa68a8a28b250d4a2c7346eff0cd14955713cbc13698a6c646d0d573602ccc0f7bda3d0c2d37f

    • SSDEEP

      6144:oNxyvPouZtK58suC/004GKXkq4RUs3fyW:oNxyXNtK58su3Z0RPj

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Modifies file permissions

    • Adds Run key to start application

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

File Deletion

2
T1107

File Permissions Modification

1
T1222

Modify Registry

2
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Impact

Inhibit System Recovery

2
T1490

Tasks