General

  • Target

    abac31b5527803a89c941cf24280a9653cdee898a7a338424bd3e9b15d792972.zip

  • Size

    8.4MB

  • Sample

    231105-clyhcsbe67

  • MD5

    5e1cbcc01083f857ff3afa6c014e65b0

  • SHA1

    caa263f9f1650cb05faca74d49fee86c7cdef427

  • SHA256

    6c303290e0afb4a55f02a89abd773d36611bb3886d239e6660bd7b172c287fe3

  • SHA512

    af8d849eebe4cf209887277479c94fd1c758075d7e3c3153cc56de1fb496732276c55683d110a41e29f697518a075e869fdf6aaca249dd5aa2a1cbb5efa4f396

  • SSDEEP

    196608:oHYfQDOyOAknv07icdAHR9lHCUfVq8i4afBsUEPnuVRobx3Rr+kT1XQTD6kL:SYfQ7OAks7icdSnlHCUqL4amhPnu8b1E

Score
10/10

Malware Config

Extracted

Path

C:\Users\Admin\Documents\lmao.html

Ransom Note
Ghost Locker 👻🏴‍☠️ We run shit because we can ALL YOUR IMPORTANT FILES ARE STOLEN AND ENCRYPTED! YOUR PERSONAL ENCRYPTION ID: GTHGZLBAXCHBJDPPSEOJHHBX (SAVE THIS) CURRENT RANSOM AMOUNT: 0.05 BTC All your files have been encrypted, don't attempt to recover it on your own as that will lead to them being permanently deleted, save your encryption ID and reach out to US via session and sending a message to the ID presented below to recover your files. All of your important files have been stolen and encrypted with RSA-2048 and AES-128 military grade ciphers. That means that no matter how much you were to try, the only way to get your files back is working with us and following our demands. You have 48 hours (2 days) to contact us. If you do not make an effort to contact us within that time-frame, the ransom amount will increase. If you do not pay the ransom, your files will be destroyed forever. You can contact us on the following 05e2fa380e1cd63a192b0753c16e56a4e305f24f3a547b036ce6c7d742ce853839 (SESSION) Session can be downloaded at: https://getsession.org/download We will not accept any other contact methods Attention! DO NOT pay the ransom to anyone else than the top contact information mentioned up there. DO NOT rename the encrypted files DO NOT try to decrypt your data using third paty software, it may cause permanent data loss Any involvement of law enforcement/data recovery teams/third party security vendors will lead to permanent loss of data and a public data release immediately
URLs

https://getsession.org/download

Targets

    • Target

      abac31b5527803a89c941cf24280a9653cdee898a7a338424bd3e9b15d792972

    • Size

      8.5MB

    • MD5

      9c66d8fde4e6d395558182156e6fe298

    • SHA1

      e59372a29c43af4d15ed77784547aae34d3a6bdc

    • SHA256

      abac31b5527803a89c941cf24280a9653cdee898a7a338424bd3e9b15d792972

    • SHA512

      bd7f1723126373de18bd54f49ef11a043c2f9b28145c62246ccf9c4485576cc2fff374f8abf1a556cecb0b72913e53d409c5b2ca4429777ef65f44434d298124

    • SSDEEP

      196608:U8bWGiYJqu4Akw8QdZmPFWUnCVPxCa/uRF4ApDPS5b1:FWGtzL1POFrCtxV/8SSDY

    Score
    10/10
    • Stops running service(s)

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks