General
Static task
static1
URLScan task
urlscan1
Malware Config
Extracted
Family
limerat
Wallets
bc1qry7pwfznecq4kakyeta9t6p7sfwr4dz0lrr3qe
Attributes
-
aes_key
8890
-
antivm
true
-
c2_url
https://pastebin.com/raw/DDTVwwbu
-
delay
3
-
download_payload
true
-
install
true
-
install_name
ForexCheater.exe
-
main_folder
AppData
-
pin_spread
true
-
sub_folder
\WindowsApps\
-
usb_spread
true
Extracted
Path
C:\cZQZLcTJI.README.txt
Ransom Note
~~~ Providence Worldwide Ransomware~~~
>>>> Your important files were encrypted!
>>>> We guarantees that we will not deceive you?
We are not a politically motivated group and we do not need anything other than your money.
We copied all of your files to our Database. Where we keep our people's information, And if
They dont pay the decryption key. to unlock their files. We leak them
Contact us so we can tell you how much is the decryption key, and
If you pay, we will provide you the programs for decryption and we will delete your data.
Is not good to see your company under maintenance.
And If you do not pay for the DECRYPTION Key we have no choice then to leak your information,
And everyone can view and buy the information with the cheap price
>>>> Note
What we noticed when we leak people's information who did not pay the ransom.
People who pay or view mostly are their compitors and their enemies
>>>> You need to contact us on Session chat with your personal DECRYPTION ID
So we can create you a Decryption Key to unlock your files
Write to a chat and wait for the answer, we will always answer you.
Download and install Session Chat: https://getsession.org/
Our Session ID to contact us: 05569cc8245e0d834eb512f3e55a56d17eb200f2d2296bf6e686cd0acd81b9980e
>>>> Your personal DECRYPTION ID: 7F31491E832F276811C39A8CBC1CE6F2
>>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems!
>>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!
>>>> Advertisement
Would you like to earn millions of dollars in Bitcoins $$$ ?
Our company acquire access to networks of various companies, as well as insider information that can help us steal the most valuable data of any company.
You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc.
Open our letter at your email. Launch the provided virus on any computer in your company.
You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us.
Companies pay us the foreclosure for the decryption of files and prevention of data leak.
You can contact us using Session Chat: https://getsession.org/
Using Session Chat, we will never know your real name, it means your privacy is guaranteed.
If you want to contact us, Message us in Session chat.
Our Session ID to contact us: 05569cc8245e0d834eb512f3e55a56d17eb200f2d2296bf6e686cd0acd81b9980e
soon we will be available in other private networks like tox and jaber
URLs
https://getsession.org/
Targets
-
-
Target
https://wormhole.app/PMKqZ#Ecjl0AqHiMQnst1kHKgAng
-
Rule to detect Lockbit 3.0 ransomware Windows payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-