Overview

overview

10

Static

static

10

3f9a28e8c0...81f362

ubuntu-18.04-amd64

10

Analysis

  • max time kernel
    5s
  • max time network
    135s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20231215-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20231215-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    04-01-2024 01:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3f9a28e8c057e7ea7ccf15a4db81f362

  • Size

    2.0MB

  • MD5

    3f9a28e8c057e7ea7ccf15a4db81f362

  • SHA1

    10d6d3c957facf06098771bf409b9593eea58c75

  • SHA256

    6a7b7147fea63d77368c73cef205eb75d16ef209a246b05698358a28fd16e502

  • SHA512

    58a71aeac247d206f023ee29aff81026881e41d3fbd268f7513e3bcd951701a68502361dd717befa79a094eb9fc0caaa9f8770ba83f5c94a8acb9ae0986ee386

  • SSDEEP

    49152:k5Wy/20shMXR8uUz9cBbLc/6LCM01iNFFB9wO:k5Wy//sO8uDq6

Score
10/10
ransomware

Malware Config

Extracted

Path

/var/log/ReadMe.txt

Ransom Note
~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your linux hosts are encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/GDBJS76DH3D4IKQD2QO7R. >> Warning! Recovery recommendations. Do not DELETE or MODIFY any files, it can lead to recovery problems!
URLs

http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/GDBJS76DH3D4IKQD2QO7R

Signatures

  • Deletes itself 1 IoCs
  • Deletes log files 1 TTPs 4 IoCs

    Deletes log files on the system.

  • Reads CPU attributes 1 TTPs 1 IoCs
  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/3f9a28e8c057e7ea7ccf15a4db81f362
    /tmp/3f9a28e8c057e7ea7ccf15a4db81f362
    1⤵
    • Writes file to tmp directory
    PID:1535

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1
T1070

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • /tmp/main.log
    Filesize

    1KB

    MD5

    52a14648c0b290b5042dd43a2b254702

    SHA1

    2107ad29777f5db94e8997c0fc0dca4a3410a741

    SHA256

    7a49b4529ef14b0a03c309effd59fcf25fb81e1a4214af5522c52f50133878fd

    SHA512

    7451d30756557fe38320c92f71215402f2730fcc89dc465528768ef59473af5e8b632008d5a7bcc82e5cafa66f7796f85c11837c8e2eb17accfdc26564356aca

    Download Submit
  • /var/log/.1BF5CC212DC7FB1A0EFC4B93CB0C38C0C67838D9DC2DF9EF
    Filesize

    512B

    MD5

    9961bb4ccf4efe57cc43f27ebeba3ccf

    SHA1

    48dc5c7b9fa60003631edee499f894e7ee0bcd8c

    SHA256

    ca0992ab2fdba5f0c70b764cce1bd26352528cc9a1f81cddfc5871d12ac0ef55

    SHA512

    5b1aba8971a5251c8b75bf6734d9ca40433efa5e64dbd23f1c51a752d9ef37a323a931cdc74297c38e102e5aeeab45b52d8d95119dbee41cce10366edca37996

    Download Submit
  • /var/log/ReadMe.txt
    Filesize

    1KB

    MD5

    a5d1d021df6f81a4137d7b58f2c94f33

    SHA1

    e5d2cd2451e8464bafb63cc6f6df74f7dc3ca4c1

    SHA256

    005191d057f679970d95c15e553229f82d66c5b1f08d5aecbd4ce4c9dc27856e

    SHA512

    d5f6f53cc7f18585214883a9de312c677e7adcc8956a01ae5583e859d730ea2be88f0ff8c297c9f1235b8695191758712845d1d6e801e5cef7979209868643c0

    Download Submit
  • /var/log/installer/.2146BC677F078171EFD9E535210536618953D86C250F460A
    Filesize

    512B

    MD5

    b0543e7af30aa7101e1c063835932689

    SHA1

    23ba4a8ac8ad9e3349fe7e175e320c99395c21d0

    SHA256

    931fcc252a3b13f10bb4fe70e131e9d5dd8e543dff0221ee8c2fe0160b130321

    SHA512

    aa31eca98ff735f1a953235ccea4379e7328dcca507c5461397354d1660d02ab4c5c964544825f119179052152d79a8b2b6c91dabc0a355efd910e7fb7e604a6

    Download Submit