General

  • Target

    4968b25781df2d8913de37ac6a0dab897ce97bbe49d7f644b29284fecff711f6.na

  • Size

    442KB

  • Sample

    240112-n12zwagba8

  • MD5

    81b760d4057c7c704f18c3f6b3e6b2c4

  • SHA1

    94c93a3b17485e75be82635229ddcfd2445747e6

  • SHA256

    4968b25781df2d8913de37ac6a0dab897ce97bbe49d7f644b29284fecff711f6

  • SHA512

    b6a0d309e4ba2e9ac063fdf137e9773281dc90ca5b182f28a6807571358332d25bc070566681198ab62592b36eaa71dbf8cc8c8898b0071d0cff6d680edb6c33

  • SSDEEP

    12288:TSk6ijDCWl0Qc4a6eCSgn/p2TzZfDt4yfoBuuRe:Ok6iPRME9n/peZfp4yfoUuRe

Malware Config

Extracted

Path

/read-me3.txt

Ransom Note
C3RB3R INSTRUCTIONS ************************************************************************* IMPORTANT : DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED!!! All your important files have been encrypted. Any attempts to restore your files with thrid-party software will be fatal for your files! The only way to decrypt your files safely is to buy the special decryption software "C3rb3r Decryptor". We have also downloaded a lot of data from your system. If you do not pay, we will sell your data on the dark web. You should get more information on our page, which is located in a Tor hidden network. 1.Download Tor browser - https://www.torproject.org/ 2.Install and run Tor browser 3.Connect with the button "Connect" 4.Open link in Tor browser : http://j3qxmk6g5sk3zw62i2yhjnwmhm55rfz47fdyfkhaithlpelfjdokdxad.onion/22028d19e1b8eab7cf6cbc66c065f0ace41671f8c2a40fde323e3a2e95ccff05603c628d5967841259e9e09927dbdd54597dc1ae870e8b380d97a78239eb134a1f3cf6374b8b7ff894d166eaf0c4926986cb38cff9727a9a34a2fc89b9f38baeeff27df12b3fca403687f97f174af2498a6ba1de15eb77c69d605f7b65de123dc6f0/ 5.The site should be loaded. if for some reason the site is not loading wait for a moment and try again 6.Follow the instructions on this page You can proceed with purchasing of the decryption software at your personal page: ************************************************************************* http://j3qxmk6g5sk3zw62i2yhjnwmhm55rfz47fdyfkhaithlpelfjdokdxad.onion/22028d19e1b8eab7cf6cbc66c065f0ace41671f8c2a40fde323e3a2e95ccff05603c628d5967841259e9e09927dbdd54597dc1ae870e8b380d97a78239eb134a1f3cf6374b8b7ff894d166eaf0c4926986cb38cff9727a9a34a2fc89b9f38baeeff27df12b3fca403687f97f174af2498a6ba1de15eb77c69d605f7b65de123dc6f0/ At this page you will receive the complete instructions how to buy the decryption software for restoring all your files. Also at this page you will be able to restore any one file for free to be sure "C3rb3r Decryptor" will help you. ATTENTION: 1.Do not try to recover files yourself, this process can damage your data and recovery will become impossible. 2.Do not waste time trying to find the solution on the internet. The longer you wait, the higher will become the decryption software price. 3.Tor Browser may be blocked in your country or corporate network. Use Tor Browser over VPN.
URLs

http://j3qxmk6g5sk3zw62i2yhjnwmhm55rfz47fdyfkhaithlpelfjdokdxad.onion/22028d19e1b8eab7cf6cbc66c065f0ace41671f8c2a40fde323e3a2e95ccff05603c628d5967841259e9e09927dbdd54597dc1ae870e8b380d97a78239eb134a1f3cf6374b8b7ff894d166eaf0c4926986cb38cff9727a9a34a2fc89b9f38baeeff27df12b3fca403687f97f174af2498a6ba1de15eb77c69d605f7b65de123dc6f0/

Targets

    • Target

      4968b25781df2d8913de37ac6a0dab897ce97bbe49d7f644b29284fecff711f6.na

    • Size

      442KB

    • MD5

      81b760d4057c7c704f18c3f6b3e6b2c4

    • SHA1

      94c93a3b17485e75be82635229ddcfd2445747e6

    • SHA256

      4968b25781df2d8913de37ac6a0dab897ce97bbe49d7f644b29284fecff711f6

    • SHA512

      b6a0d309e4ba2e9ac063fdf137e9773281dc90ca5b182f28a6807571358332d25bc070566681198ab62592b36eaa71dbf8cc8c8898b0071d0cff6d680edb6c33

    • SSDEEP

      12288:TSk6ijDCWl0Qc4a6eCSgn/p2TzZfDt4yfoBuuRe:Ok6iPRME9n/peZfp4yfoUuRe

    Score
    10/10
    • Renames multiple (2461) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Deletes itself

    • Creates/modifies environment variables

      Creating/modifying environment variables is a common persistence mechanism.

    • Modifies Bash startup script

MITRE ATT&CK Enterprise v15

Tasks