dec0eb0f0e6657ead1b69b04b8ddc2ba991d35bf6e0ed51ba4cc0fd53e6f2417

General

Target

NoEscape.zip
Size

320KB
Sample

231229-pbfk1sgha8
MD5

aba22c7af3487c57d4d36c59a8aedede
SHA1

ee8457fabb39b72ef44f99a21770dd1589ecc2c2
SHA256

dec0eb0f0e6657ead1b69b04b8ddc2ba991d35bf6e0ed51ba4cc0fd53e6f2417
SHA512

59f6edf5ea71d2e71a00f46d24ec42bba417dce342cba3bc379356aac1996ca79b2fbe7d2993a9530f24fc1d7203eeda94bad02cd76f39f313ff1dcd54f5af4b
SSDEEP

6144:YG0WYFhrFT7oU7FogVZEONa46kvQ+KydAiNiucBBIb6+3+8ll8uZpGSAV:kzFtJNRRPEMP6gWiNiuc8+j8ll9pGh

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\HOW_TO_RECOVER_FILES.txt

Ransom Note

> WHAT HAPPEND? Important files on your network have been ENCRYPTED and now have the extension .BEAFHHJCJH. To recover your files, you need to follow the instructions below. > SENSITIVE DATA Sensitive data from your network has been DOWNLOADED. If you DON'T WANT to your sensitive data PUBLISHED on our leak blog, you must act quickly. LEAK BLOG: noescapemsqxvizdxyl7f7rmg5cdjwp33pg2wpmiaaibilb4btwzttad.onion Data includes: - Personal data of employees, resume, DL, SSN. - Complete network map, including credentials for local and remote services. - Private financial information including: customer data, accounts, budgets, annual reports, bank statements. - Production documentation, including: datagrams, diagrams, drawings. - And much more... Sample DOWNLOADED FILES are available in your user panel. > CAUTION DO NOT MODIFY ENCRYPTED FILES BY YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, THIS WILL RESULT IN PERMANENT DATA LOSS. > WHAT SHOULD I DO NEXT? You need to contact us: 1. Download and install TOR browser: https://www.torproject.org/ 2. Go to your user panel: bwjbbpbcihglahwxxusmyy2nxqdc4oqy4rvyhayn4dxhqzji4qi7taid.onion/9aa2579b-2563-4b08-a614-d4f04bdf60a1-uB5wmqiXqjhZ If you have difficulties with authorization in the client panel, you can use the contact form in the "LEAKS BLOG" to contact us

URLs

http://noescapemsqxvizdxyl7f7rmg5cdjwp33pg2wpmiaaibilb4btwzttad.onion

http://bwjbbpbcihglahwxxusmyy2nxqdc4oqy4rvyhayn4dxhqzji4qi7taid.onion/9aa2579b-2563-4b08-a614-d4f04bdf60a1-uB5wmqiXqjhZ

Extracted

Path

C:\odt\HOW_TO_RECOVER_FILES.txt

Ransom Note

> WHAT HAPPEND? Important files on your network have been ENCRYPTED and now have the extension .DCCEHIBEJI. To recover your files, you need to follow the instructions below. > SENSITIVE DATA Sensitive data from your network has been DOWNLOADED. If you DON'T WANT to your sensitive data PUBLISHED on our leak blog, you must act quickly. LEAK BLOG: noescapemsqxvizdxyl7f7rmg5cdjwp33pg2wpmiaaibilb4btwzttad.onion Data includes: - Personal data of employees, resume, DL, SSN. - Complete network map, including credentials for local and remote services. - Private financial information including: customer data, accounts, budgets, annual reports, bank statements. - Production documentation, including: datagrams, diagrams, drawings. - And much more... Sample DOWNLOADED FILES are available in your user panel. > CAUTION DO NOT MODIFY ENCRYPTED FILES BY YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, THIS WILL RESULT IN PERMANENT DATA LOSS. > WHAT SHOULD I DO NEXT? You need to contact us: 1. Download and install TOR browser: https://www.torproject.org/ 2. Go to your user panel: bwjbbpbcihglahwxxusmyy2nxqdc4oqy4rvyhayn4dxhqzji4qi7taid.onion/9aa2579b-2563-4b08-a614-d4f04bdf60a1-1IkdMc1ofqOX If you have difficulties with authorization in the client panel, you can use the contact form in the "LEAKS BLOG" to contact us

URLs

http://noescapemsqxvizdxyl7f7rmg5cdjwp33pg2wpmiaaibilb4btwzttad.onion

http://bwjbbpbcihglahwxxusmyy2nxqdc4oqy4rvyhayn4dxhqzji4qi7taid.onion/9aa2579b-2563-4b08-a614-d4f04bdf60a1-1IkdMc1ofqOX

Targets

- Target
  
  6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49
- Size
  
  510KB
- MD5
  
  13ccbab51e6ab57c89ad99f3f676c7f3
- SHA1
  
  673fc190f8fb4f7c921de900cedb2f213982c416
- SHA256
  
  6166c0fe1eb887fa4d0719c4cb4fb5d55dd249fab11ba6fb9a3114a5964b1d49
- SHA512
  
  7c2226b18cdd7a3e6cea078960292c4a8b1c19d39fe692f97ca8b21c90ee25a126c2a8ca65c49e222ce3d691b0e73645a21102fb12a65db1da7a4c6bd1dfba46
- SSDEEP
  
  12288:PVQfoJw+q6puobmO/OSST0qU2bwnq7hPVWc4d5pi:PHZh/dSsE0shP
Score

10^/10

evasion ransomware trojan
- UAC bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Renames multiple (145) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2