General

  • Target

    200713-5x5vderhsx_pw_infected.zip

  • Size

    2.5MB

  • Sample

    231012-2mmvpadh6z

  • MD5

    36f0b2838afd49394ec12fbcbb6a29e2

  • SHA1

    9cfaa1d11e791556f747fef16efa1c04c6d84b81

  • SHA256

    81fb00c585e1c2379fc3241d104e62f6e106e8dfc1d4a73f8e878f2975740613

  • SHA512

    222eb801b5fc6884428ae5d8ca5e26c79f5f55004a3fc9299bbf370e85c2f113295c5f7d4ba9ce716fd0d9252f6ea11cd57f474f60115e675d57ea770698b8fb

  • SSDEEP

    49152:jKKSikpMP6yYGzs+3SztKZkdP+uxk11vqH964AYLA7+ufeWQ:TShmrz7CzoZiP+uW11CdpTLs+ufeWQ

Score
10/10

Malware Config

Extracted

Path

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\HOW TO RESTORE YOUR FILES.TXT

Ransom Note
Hello! All your files are encrypted, write to me if you want to return your files - I can do it very quickly! Contact me by email: support911@cock.li or Xilttbg@Tutanota.com The subject line must contain an encryption extension or the name of your company! Do not rename encrypted files, you may lose them forever. You may be a victim of fraud. Free decryption as a guarantee. Send us up to 3 files for free decryption. The total file size should be no more than 1 MB! (not in the archive), and the files should not contain valuable information. (databases, backups, large Excel spreadsheets, etc.) !!! Do not turn off or restart the NAS equipment. This will lead to data loss !!!
Emails

support911@cock.li

Xilttbg@Tutanota.com

Targets

    • Target

      1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593

    • Size

      4.6MB

    • MD5

      7d9c6313b2e412f0db4380b279eb4fed

    • SHA1

      0675b3958e7eef4090775f665d8201837f167f01

    • SHA256

      1d67abe1ec08e6215e08d6bb595ade3d1d33d0e886edf887b29f4d8e1d46e593

    • SHA512

      ddaa21b661f448442df6556dec57429636e7aa6fa9ce4f098ac218cc702b301903c7bf254b9aee732a90561402b420d977be6bb7940bf49aa55e0e5f9991075e

    • SSDEEP

      98304:OOTXCHbq9evuviwF+Mc42HfPt5Sqg9pkJ:3LCHbqwvuvi40HN5Tgi

    Score
    10/10

MITRE ATT&CK Matrix

Tasks