General

  • Target

    2023-08-22_ff1f6956f07e700a86b5986b63ea12db_revil_JC.exe

  • Size

    126KB

  • Sample

    230903-r9t76sba72

  • MD5

    ff1f6956f07e700a86b5986b63ea12db

  • SHA1

    a8d88813f2691cf71e8d6790e473593644c913ed

  • SHA256

    3e6fbc358e0204cb67a41b05771fac74f1b49737c7ab7138e415c7e9628ef545

  • SHA512

    04f4d29f37079ef04e2b1be812d20d89dca82e4fffff28047de435425a18573cc3edfd5b148e0aded71d652583785e82585c708e0fc38b5dbda61962cbb1f927

  • SSDEEP

    1536:YxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6QdZls8XzUXiWr4X5Fg:YMhQNDEtb3A2ZHjUyWr4X5FTDUA

Malware Config

Extracted

Path

C:\Users\n430ar4kv-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension n430ar4kv. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B1D679FE97CFEA5D 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/B1D679FE97CFEA5D Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: f3bjknY7/+4Nq0P/w53HCp5wmfJXrvC4VVzP3BuN/kZfVjlo2PUhPovbagi9YQIy F2SPf52tSAXQIEzHyV3S4/mLuYvlMLDf15WF8WcRotQpGEh6VzYevFwrxxQjvKgm QPtS39qpWHBa/+JaT4+dasXhdscHCFmg+bw5JQpr3IuOtblLuSva/qLjesXvWYu0 803I4QpP2tgpXRSxSANu9hbzOzHPpEvePlFtbshynrwJ7UvG5KNwgephLnLRVr2S 41HoT1cnDdAT0LlfFWBGmUY3GfbX1n+cY8ViVvzYhN35i0ds4Xidl6hayHHry3ke F0lcf8AdGbo+1jBJQhNteq0UlRaZsf4srffNg8khaZLtRID+Z9gShwSCxFTqw2EV 8AXQieyRzTXK++MezKLUhT/D6M5qrDUNnnkzjWQBeUfflohTtKh+jw22RDZ/09sN sdVQjTBdP5tyC9oNoTo3wsg2Q/xwQY4gf+oS4yyD7dTLf4ALkIC0/j0qPiAiM2XB kw5qotgxiXGKNltYeYLpcR+qfCkM3/9LHaYYeUBXbwl4PtpD0OOiueCNoqxl7oH7 CSmx6eRm1nI3modkvawKPJbIQ0Qb5uz9o764U1GnYbqjutfiBwLz4WjFrwqSPePy T4+JLkAZWQ6NfHsdb5MtrGd8VgCxwJBnnlswNgsNPlOHjvynTnPurnkG6InplN0F AzuAh9pGt8tWGj5kv34NE06h7gXSWAlxsSE+H3da9fe6u4IMJwa6GIKnruFNZuYd 3TC158Tv4iwiBWwpFSR61GEGEi46pT4PlvMj8Gam/drYOoD4dRRCbnH6TCnKKeGx diMeelA4pb4VpcMr+iPwB1fS04YtMe+AirA68usg7IBGb8bzUZgkrXDyktHAY6yH AEzM+UvMTkR5qsVugqGMVRCbQzJStXibUVxZv8h72SxnDsevMwihFDZaENBFhI2l oVWmc/oeYCaSVnXnGqeVDp/e8aCUIYbtWa3fWj4h0NNU0MyBf/c/hJn6cqCRthLf PueTdd5mM6otsUB8qZ2L5IqfttuEhReYYjHP4e1knzn/uoNilKWZEN78Lhn58jMk ADyqTMhl5uEMLCor+Xh1oGQDniw7G+plNNhljbF5GOR3kielAH0mPciMdsy3Uhv/ YlS5Jobbfg6mv7rxG9u4DE/WEkGI++E/Sl0alynmc7sSFgGTpB4IW/j2f0PRICT0 /VugDBcOQpXu8p56YEX0CaPT/ZeO0QM+xi3HZsfR9kehkdYo2TswsXRFjMQqIrig pgo+Rqcy+ojokpVVDUv+Zg7Q5hSbtDLh0rlmovz6J1VkK32ruvgUxD3p0iQESG6l 2SZ/xtkQtEIpUWX1sNv1wtvTiz5Pvv1bz0Mmvw== ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B1D679FE97CFEA5D

http://decoder.re/B1D679FE97CFEA5D

Extracted

Path

C:\Recovery\8e1ikou-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 8e1ikou. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C228E7916B17DB67 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/C228E7916B17DB67 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 8iSg09n+/3WXGKlsyeXhDOpU/5C9OO/dF8ni1sQemCYAFPiTRDnT3S2pSPO43WeS 0+tz/na86QTcexwWHy76qhVwJVyguhoBQVyonmU5GO7PhST7ZHLV6x/g5LTOIYQe cXFwdUEPYo0jRAHBjkaUYhNUZ1CcK14/R0gK1Zi0VaQR8EsaA+t7AhknYCUWwZLB FoNtJC3qukLoR9OTUyj2JUpqXvn72zVz4wrM+DXvGUDdPcNHsIp4ELqqBodyV83m YyTCKsTD0sftPxdog7NjCyqJKilknKeLr4IGZYQybrbDkv7WJPT6FMVbigKUPFT6 tVbuJksY0iamy389Ls6+R322fKISK4WGufUhSKelbZdo6n5r3GpYi/yhoOm55i1Z 8Ox987xClsPSzLIITYxCRJnJil7Y/6wRghYYE/hVJZH6LpLzXvQM9LtY70NX1p5l vys1Wm3m0ShF20YomcaMYZrhsL/HMPLA/8OoxT5108AtgT+hY+s22ifKySrAr+tD Afh5RjyC1V7GigXVfhv2xEjashIxA+WBC9zL1XQN0fTa60TJEdqDViez108dDd7A Ut5R+eGIHZWBgxvw5LOTy3UQ+3vLq9gBBFNuKlyZSqVwOmipiaDCFpV/KkYpyIP5 1RTFe1mVNT038Z89sUZsHc4VieZYRZiy/mLvAoByJC2eh9ZHTeWERA4es6EyEI31 Lu8Zb7RTdotP6itLD3JV3KCvFwXaGnpNvL0ObJoET98/d5W9QVwpaDtBknz94NfR ssUoAf3hRQROMKTNfy5hcPIZBNeOVCTAEwhy3WSNdJdkXcsMvVg+KsFWnXY7bCFp gP9Ze1I80RH8IdQ78NKjVMWwrHsNA0uiqd4sCaLWA4/CWUAfqu1uQdprDhiofRBp b3eqoDJXE0QenNRPDlXfDUFv/cL+ZAWcgaCvThQGv0awjwyA4IaRp43j9qM0DMsq HoiyIav5RMhwK6kuTi0rDoJD+MJVRKwDXrp4X5qrhfbbX/anDB4wG/+OmrmQujEO niK1ZMQMKiIBzMqcHy27BR/S8fs5lZ4Wq1sl9ATvcYWZ0XMbLucO7RSKoT6/Ni5b lOXzLVTNwpMWzoENppkKQziw+RJediWW2wVnqUDzwuheqk4QUicuwxnvm4s+s+kv uDC6D/CTHIXW8s6zgf+9WwIzILSd9PwKYT9p60wYnvBTqSX+ptTYQ2zaJOpHhRo6 6ZqPzmhCg4UB/1PTQPAtU1xc5pwBmP4EaAxtoXdv2A8bepSSIYgJWLPB7rPWL1O5 yIoqdhs8UfavRpY+aLNsHUKjt1n7/5Vxytj3Ftoj55fP/Vg83UsxzxY2uofw84u9 /cbruVV427UPLDHGgBwlOk9HyeQS/n2emLEarbXQ ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C228E7916B17DB67

http://decoder.re/C228E7916B17DB67

Targets

    • Target

      2023-08-22_ff1f6956f07e700a86b5986b63ea12db_revil_JC.exe

    • Size

      126KB

    • MD5

      ff1f6956f07e700a86b5986b63ea12db

    • SHA1

      a8d88813f2691cf71e8d6790e473593644c913ed

    • SHA256

      3e6fbc358e0204cb67a41b05771fac74f1b49737c7ab7138e415c7e9628ef545

    • SHA512

      04f4d29f37079ef04e2b1be812d20d89dca82e4fffff28047de435425a18573cc3edfd5b148e0aded71d652583785e82585c708e0fc38b5dbda61962cbb1f927

    • SSDEEP

      1536:YxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6QdZls8XzUXiWr4X5Fg:YMhQNDEtb3A2ZHjUyWr4X5FTDUA

    Score
    10/10
    • Modifies Windows Firewall

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks