Analysis

  • max time kernel
    3s
  • max time network
    4s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20221111-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    03-05-2023 14:49

General

  • Target

    3d375d0ead2b63168de86ca2649360d9dcff75b3e0ffa2cf1e50816ec92b3b7d.elf

  • Size

    102KB

  • MD5

    96a157e4c0bef22e0cea1299f88d4745

  • SHA1

    446771415864f4916df33aad1aa7e42fa104adee

  • SHA256

    3d375d0ead2b63168de86ca2649360d9dcff75b3e0ffa2cf1e50816ec92b3b7d

  • SHA512

    697071bac6f86ea1b0421306dbc87e926973f061b8eff4608f9a98ada622fe2bdcd45a180591792dd14de54a0b87301ae02f0a3a222e93eb412b340ccc990377

  • SSDEEP

    3072:Gb+XoBHJ3RYjgggwgggwgggwgggwgggZQuYoL/:GDaoL

Score
10/10

Malware Config

Extracted

Path

/tmp/.Test-unix/qoxaq-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension qoxaq. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/604D4AF1604D4AF1 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/604D4AF1604D4AF1 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: rhhW41p/ke67hM74AzahHJIPIJWktdrAQwXg7xvDO2tQCs6QxTyj8eWzfh5xkvd2RWWMjRKC5Fg/6SGn8ifO6l+3WI5b5fr3p/J+UvvChGNvCndUpR+NWLCAyN52sAtOwGBmYTy5pYHenN98hzdCITfOHtg17T2GUZevpf+xMNlinpQnenbw5xvD/jCNuKxiPiyaDSqn+ReTX6dt/15U+3dybSRnqTF92249NOmfeSHWDdKk0b9M1sMLXGqnAqrRJXVtTmnV0v/RuTU/fBvKUN6HBOQbk+CAHTuf/mRwNl2cehvyFXxU2k04SM15IKt4BNYDQU9TYKCLP3WzXoFanOnP8LN2rCEc7aQtUfpGwCt9z5yXDj4dq2rS6QNkJxyeE+4quOzlM+vfosX3RXQO54A3H81JOgTPSwAGhwx9aZCKMh3ct1SyQOazwqAygTJEvhPfLn+Zy2DSj5LZjazPrHF526CO3StV3wBMQUVpyQDILZ5VeKlkykIICbictLQPbOGmvNIb1w99C32KJg== ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/604D4AF1604D4AF1

http://decoder.re/604D4AF1604D4AF1

Signatures

  • Reads CPU attributes 1 TTPs 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 14 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/3d375d0ead2b63168de86ca2649360d9dcff75b3e0ffa2cf1e50816ec92b3b7d.elf
    /tmp/3d375d0ead2b63168de86ca2649360d9dcff75b3e0ffa2cf1e50816ec92b3b7d.elf
    1⤵
    • Writes file to tmp directory
    PID:586
    • sh
      sh -c "uname -a && echo \" | \" && hostname"
      2⤵
        PID:587
        • uname
          uname -a
          3⤵
            PID:588
          • hostname
            hostname
            3⤵
              PID:589
          • sh
            sh -c "uname -a && echo \" | \" && hostname"
            2⤵
              PID:590
              • uname
                uname -a
                3⤵
                  PID:591
                • hostname
                  hostname
                  3⤵
                    PID:592
                • sh
                  sh -c "pkill -9 vmx-*"
                  2⤵
                    PID:593
                    • pkill
                      pkill -9 "vmx-*"
                      3⤵
                      • Reads CPU attributes
                      • Reads runtime system information
                      PID:594
                  • sh
                    sh -c "esxcli --formatter=csv --format-param=fields==\"WorldID,DisplayName\" vm process list | awk -F \"\\\"*,\\\"*\" '{system(\"esxcli vm process kill --type=force --world-id=\" \$1)}'"
                    2⤵
                      PID:595
                      • awk
                        awk -F "\"*,\"*" "{system(\"esxcli vm process kill --type=force --world-id=\" \$1)}"
                        3⤵
                          PID:597

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • /tmp/.Test-unix/qoxaq-readme.txt

                      Filesize

                      2KB

                      MD5

                      fa16f8fe9bfae53621cc729aad65b5dc

                      SHA1

                      b12944c1673a9c7592a2420e6ba5f06721e0e380

                      SHA256

                      d71419b19aa480db5785d069335cbdeec49acfba1d18b9bf916f177315c10e97

                      SHA512

                      7862096e561b352f80d26ce9694bf50a1756106660fda6528f09a343d56f3dc314726254cec7e78de2a62f76c63e57310aa2437615c0593b89e9d1caaa3d8677