General

  • Target

    https://wormhole.app/PMKqZ#Ecjl0AqHiMQnst1kHKgAng

  • Sample

    230411-jtr4wabc74

Malware Config

Extracted

Family

limerat

Wallets

bc1qry7pwfznecq4kakyeta9t6p7sfwr4dz0lrr3qe

Attributes
  • aes_key

    8890

  • antivm

    true

  • c2_url

    https://pastebin.com/raw/DDTVwwbu

  • delay

    3

  • download_payload

    true

  • install

    true

  • install_name

    ForexCheater.exe

  • main_folder

    AppData

  • pin_spread

    true

  • sub_folder

    \WindowsApps\

  • usb_spread

    true

Extracted

Path

C:\cZQZLcTJI.README.txt

Ransom Note
~~~ Providence Worldwide Ransomware~~~ >>>> Your important files were encrypted! >>>> We guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. We copied all of your files to our Database. Where we keep our people's information, And if They dont pay the decryption key. to unlock their files. We leak them Contact us so we can tell you how much is the decryption key, and If you pay, we will provide you the programs for decryption and we will delete your data. Is not good to see your company under maintenance. And If you do not pay for the DECRYPTION Key we have no choice then to leak your information, And everyone can view and buy the information with the cheap price >>>> Note What we noticed when we leak people's information who did not pay the ransom. People who pay or view mostly are their compitors and their enemies >>>> You need to contact us on Session chat with your personal DECRYPTION ID So we can create you a Decryption Key to unlock your files Write to a chat and wait for the answer, we will always answer you. Download and install Session Chat: https://getsession.org/ Our Session ID to contact us: 05569cc8245e0d834eb512f3e55a56d17eb200f2d2296bf6e686cd0acd81b9980e >>>> Your personal DECRYPTION ID: 7F31491E832F276811C39A8CBC1CE6F2 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again! >>>> Advertisement Would you like to earn millions of dollars in Bitcoins $$$ ? Our company acquire access to networks of various companies, as well as insider information that can help us steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. You can do it both using your work computer or the computer of any other employee in order to divert suspicion of being in collusion with us. Companies pay us the foreclosure for the decryption of files and prevention of data leak. You can contact us using Session Chat: https://getsession.org/ Using Session Chat, we will never know your real name, it means your privacy is guaranteed. If you want to contact us, Message us in Session chat. Our Session ID to contact us: 05569cc8245e0d834eb512f3e55a56d17eb200f2d2296bf6e686cd0acd81b9980e soon we will be available in other private networks like tox and jaber
URLs

https://getsession.org/

Targets

    • Target

      https://wormhole.app/PMKqZ#Ecjl0AqHiMQnst1kHKgAng

    • LimeRAT

      Simple yet powerful RAT for Windows machines written in .NET.

    • Lockbit

      Ransomware family with multiple variants released since late 2019.

    • Rule to detect Lockbit 3.0 ransomware Windows payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v6

Tasks