Overview

overview

10

Static

static

10

075F9A8B9A...C5.exe

windows7-x64

1

075F9A8B9A...C5.exe

windows10-2004-x64

1

145F7ABE9A...EA.exe

windows7-x64

10

145F7ABE9A...EA.exe

windows10-2004-x64

10

1A99AC759F...31.exe

windows7-x64

3

1A99AC759F...31.exe

windows10-2004-x64

3

1BE33E4291...2D.exe

windows7-x64

10

1BE33E4291...2D.exe

windows10-2004-x64

10

2188BAE387...0C.dll

windows7-x64

3

2188BAE387...0C.dll

windows10-2004-x64

3

22F524ABC9...92.exe

windows7-x64

10

22F524ABC9...92.exe

windows10-2004-x64

10

33381793BD...5E.exe

windows7-x64

1

33381793BD...5E.exe

windows10-2004-x64

1

61C0810A23...A1.exe

windows7-x64

1

61C0810A23...A1.exe

windows10-2004-x64

1

676A2A0D88...CB.exe

windows7-x64

7

676A2A0D88...CB.exe

windows10-2004-x64

7

73D29DEAC4...09.exe

windows7-x64

1

73D29DEAC4...09.exe

windows10-2004-x64

1

81EFD50EB3...29.exe

windows7-x64

7

81EFD50EB3...29.exe

windows10-2004-x64

7

8E83C0F656...07.exe

windows7-x64

10

8E83C0F656...07.exe

windows10-2004-x64

10

99CA9F3245...E2.exe

windows7-x64

5

99CA9F3245...E2.exe

windows10-2004-x64

5

B1E12D0216...06.exe

windows7-x64

10

B1E12D0216...06.exe

windows10-2004-x64

10

C6185A23C5...C8.exe

windows7-x64

10

C6185A23C5...C8.exe

windows10-2004-x64

10

CDCFEDDB0A...3E.exe

windows7-x64

10

CDCFEDDB0A...3E.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Sam.zip

  • Size

    71.0MB

  • MD5

    aeca1da0def416e2bade2fce8fb795c2

  • SHA1

    1a3b59b99f90280eea93d964ba36b15f2fbce772

  • SHA256

    3ca0bf28baacf269c3f6a7215516ae6c2181487f006f192ecac3537595a792c2

  • SHA512

    ce4fb3b30f4246ecfaea97d653a9cbe5193869e05980168f2ae972715fc9ba8f0f47d592e2d7ed75d4cef998f728c31335f01fb036f7b20b6e29218225f8eaf9

  • SSDEEP

    1572864:KSppUOHAPdPLq90QO7q52M8x47QzCLJwg4Opy+DMRNrID9:PppUxY2TOkM8xytLJ0OpSJy9

Score
10/10
upxaspackv2vmprotectmimikatzphorphiexblackcat

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/twizt/

http://185.215.113.66/
Wallets

12SJv5p8xUHeiKnXPCDaKCMpqvXj7TABT5BSxGt3csz9Beuc

1A6utf8R2zfLL7X31T5QRHdQyAx16BjdFD

3PFzu8Rw8aDNhDT6d5FMrZ3ckE4dEHzogfg

3BJS4zYwrnfcJMm4xLxRcsa69ght8n6QWz

qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k

XgWbWpuyPGney7hcS9vZ7eNhkj7WcvGcj8

DPcSSyFAYLu4aEB4s1Yotb8ANwtx6bZEQG

0xb899fC445a1b61Cdd62266795193203aa72351fE

LRDpmP5wHZ82LZimzWDLHVqJPDSpkM1gZ7

r1eZ7W1fmUT9tiUZwK6rr3g6RNiE4QpU1

TBdEh7r35ywUD5omutc2kDTX7rXhnFkxy5

t1T7mBRBgTYPEL9RPPBnAVgcftiWUPBFWyy

AGUqhQzF52Qwbvun5wQSrpokPtCC4b9yiX

bitcoincash:qpzj59cm0dcyxy9597x927fx0wzu75nns5lsm2452k

4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK

GCVFMTUKNLFBGHE3AHRJH4IJDRZGWOJ6JD2FQTFQAAIQR64ALD7QJHUY

bnb1rcg9mnkzna2tw4u8ughyaj6ja8feyj87hss9ky

bc1qzs2hs5dvyx04h0erq4ea72sctcre2rcwadsq2v

Extracted

Family

blackcat

Attributes
  • enable_network_discovery

    true

  • enable_self_propagation

    true

  • enable_set_wallpaper

    true

  • extension

    kh1ftzx

  • note_file_name

    RECOVER-${EXTENSION}-FILES.txt

  • note_full_text

    >> What happened? Important files on your network was ENCRYPTED and now they have "${EXTENSION}" extension. In order to recover your files you need to follow instructions below. >> Sensitive Data Sensitive data on your system was DOWNLOADED. If you DON'T WANT your sensitive data to be PUBLISHED you have to act quickly. Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Private financial information including: clients data, bills, budgets, annual reports, bank statements. - Manufacturing documents including: datagrams, schemas, drawings in solidworks format - And more... >> CAUTION DO NOT MODIFY ENCRYPTED FILES YOURSELF. DO NOT USE THIRD PARTY SOFTWARE TO RESTORE YOUR DATA. YOU MAY DAMAGE YOUR FILES, IT WILL RESULT IN PERMANENT DATA LOSS. >> What should I do next? Follow these simple steps to get everything back to normal: 1) Download and install Tor Browser from: https://torproject.org/ 2) Navigate to: http://rfosusl6qdm4zhoqbqnjxaloprld2qz35u77h4aap46rhwkouejsooqd.onion/?access-key=${ACCESS_KEY}

rsa_pubkey.plain

Signatures

  • Blackcat family
    blackcat
  • Mimikatz family
    mimikatz
  • Phorphiex family
    phorphiex
  • mimikatz is an open source tool to dump credentials on Windows 2 IoCs
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Unsigned PE 18 IoCs

    Checks for missing Authenticode signature.

Files

  • Sam.zip
    .zip
  • 075F9A8B9A5A3F3C221CFA69BA8B3590CFB873946970B7F3DBD333A580D24AC5
    .exe windows:5 windows x64 arch:x64

    488309467553d2fb06d7c47c60f45f19


    Headers

    Imports

    Sections

  • 145F7ABE9ABFFD0422F1C1F4CF429E89FD9D3BE93E6C3A0DD852DB708992C4EA
    .exe windows:6 windows x86 arch:x86

    46afc61b34fb8e20ac7399f0df86ba31


    Code Sign

    Headers

    Imports

    Sections

  • 1A99AC759FCD881729B76C2904476B4201E794DF2D0547C954EA37BE7C153131
    .exe windows:4 windows x86 arch:x86

    9e604fa03f90625680ac2f8bef162aff


    Code Sign

    Headers

    Imports

    Sections

  • 1BE33E42910515D58685E4CEE83C4C9B7DE4E6A155A6FD936922682A9922D42D
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • 2188BAE387FD2665D807D0B67B916973478CBE417D2042A146C8EADF77AF600C
    .dll windows:5 windows x86 arch:x86

    0793fc5146cb2625c14847ed7595a3e4


    Headers

    Imports

    Exports

    Sections

  • 22F524ABC98F958705FEBD3761BEDC85EC1AE859316A653B67C0C01327533092
    .exe windows:5 windows x86 arch:x86

    2f2316fb946682a102e453a8ae405904


    Headers

    Imports

    Sections

  • 33381793BD156716647F2C2E14047AA5559E940FF584D3FF6110B96EB701115E
    .exe windows:6 windows x64 arch:x64

    8ff66358ad21b91025a7d57a44f46f77


    Headers

    Imports

    Exports

    Sections

  • 61C0810A23580CF492A6BA4F7654566108331E7A4134C968C2D6A05261B2D8A1
    .exe windows:5 windows x64 arch:x64

    55ee500bb4bdfc49f27a98ae456d8edf


    Headers

    Imports

    Sections

  • 676A2A0D88A79012300A63092DA090F5B0D0BDFC105541732254E0AE1FEB2FCB
    .exe windows:5 windows x86 arch:x86

    fcf1390e9ce472c7270447fc5c61a0c1


    Headers

    Imports

    Sections

  • 73D29DEAC41E022CE77730F74D5EFB0828F56D1F2BEB91FD24ABC867F851FE09
    .exe windows:4 windows x86 arch:x86


    Code Sign

    Headers

    Sections

  • 81EFD50EB374AD2176E2655AF10276079F733C0592E83E3A044253DCBE06F329
    .exe windows:5 windows x64 arch:x64


    Code Sign

    Headers

    Sections

  • out.upx
    .exe windows:5 windows x64 arch:x64


    Headers

    Sections

  • 8E83C0F6566169AF1CF6C28670DCEE6EDEB15D0913AA24AD3831C9F97EB42307
    .exe windows:6 windows x64 arch:x64

    ee26deb5354c4489ff0dc7547168b2dc


    Headers

    Imports

    Sections

  • 99CA9F3245265C2F9D395B4B3A8554056E481C6FEE98B839C9C5ADB5B79E0DE2
    .exe windows:6 windows x86 arch:x86

    ecfa3f838c234923c36b9ec2755e3398


    Headers

    Imports

    Sections

  • B1E12D0216A946329FE549E09BF481D7DF9E8E3BC3F99BC24D9940CBB8F76F06
    .exe windows:5 windows x86 arch:x86

    6a50fba0b2beed26e23e37e0922bd3df


    Headers

    Imports

    Sections

  • C6185A23C51B8AC77E6C1BDF2CD4A8D39B02AF8B8027D4162CF9766D19CF87C8
    .exe windows:6 windows x86 arch:x86

    5de3d424cd6789b476f93abd644dde5a


    Headers

    Imports

    Sections

  • CDCFEDDB0ACA42E65E6A4822C1F23DF7C4AE92775EBCC0B45D4160B732B0983E
    .exe windows:5 windows x86 arch:x86

    2ffdf0a1519d1adada787fd4df5a5fec


    Headers

    Imports

    Sections

  • E9F944AB296BCAA235EB584D6B7FA2811FC1A0F3BC2596A99675CDD114CDFCF5
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • ECEA6B772742758A2240898EF772CA11AA9D870AEC711CFFAB8994C23044117C
    .exe windows:4 windows x86 arch:x86

    55c1bce75ad836c886b7fb6bca398063


    Headers

    Imports

    Sections

  • F2AB1AA34D0F6FC9CD8F6DB413E96E7FECB62A63738DB603FB41C1BDA722D5FB
    .exe windows:5 windows x86 arch:x86

    0b825660c7d5ed229100a6d233732e14


    Headers

    Imports

    Sections

  • F98B98404ECF3871A10A290ADE21AD77D0B2633F47247DEBC53D094B9BDFF245
    .exe windows:4 windows x86 arch:x86

    4a5f27cb90c03dbe6c8fb093cd390d3a


    Headers

    Imports

    Sections