Overview

overview

10

Static

static

1

3qtae89jaz...g3.exe

windows7-x64

1

3qtae89jaz...g3.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    3qtae89jazaachaa4wg3.exe
  • Size 1.1MB
  • Sample230901-kmkxnaea57
  • SHA256 5ebc114af099dbf4ce24cd2cad3e5ab783383d2217520e162fcc21feca88d3b9
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
ransomware

Malware Config

Extracted

Path

  • C:\Users\How To Restore Your Files.txt

Ransom Note
  • All your documents, company files, images, etc (and there are a lot of company data) have been encrypted and the extension has been changed to .knight_l . The recovery is only possible with our help. US $19907 in Bitcoin is the price for restoring all of your data. This is the average monthly wage for 1 employee in your company. So don't even think about negotiating. That would only be a waste of time and you will be ignored. Send the Bitcoin to this wallet:1KMrYm8x48b2cVPxpPVCuLsSUxMMVtvrsR (This is your only payment address, please don't pay BTC to other than this or you won't be able to get it decrypted!) After completing the Bitcoin transaction, send an email at: http://knightv5pdwrrfyxghivy3qccxxghk2yfyfigur562gcnmpmgd4pgfid.onion/a60ce96b-5998-4e26-85ac-0bb477fb3ae2/ (Download and install TOR Browser (https://www.torproject.org/).[If you don't know how to use it, do a Google search!]).You will get an answer as soon as possible. I expect a message from you with the transfer of BTC Confirmation (TXID). So we can move forward to decrypt all your data. TXID is very important because it will help us identify your payment and connect it to your encrypted data.Do not use that I am here to waste mine or your time. How to buy the BTC? https://www.binance.com/en/how-to-buy/bitcoin https://www.coinbase.com/how-to-buy/bitcoin Note: Your data are uploaded to our servers before being encrypted, Everything related to your business (customer data, POS Data, documents related to your orders and delivery, and others). If you do not contact us and do not confirm the payment within 4 days, we will move forward and will announce the sales of the extracted data. ID:3e8321c03af7a8dcf59acb59b616622ba3c2a3979c7382446fc9e7dc7601384e
URLs

  • http://knightv5pdwrrfyxghivy3qccxxghk2yfyfigur562gcnmpmgd4pgfid.onion/a60ce96b-5998-4e26-85ac-0bb477fb3ae2/

  • https://www.binance.com/en/how-to-buy/bitcoin

Targets

    • Target
      3qtae89jazaachaa4wg3.exe
    • Size 1.1MB
    • SHA256 5ebc114af099dbf4ce24cd2cad3e5ab783383d2217520e162fcc21feca88d3b9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    ransomware

    • Renames multiple (156) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks