Resubmissions

31/01/2024, 13:08

240131-qdlqgscgd6 10

28/01/2024, 15:53

240128-tbwdpachf2 9

General

  • Target

  • Size

    120KB

  • Sample

    240131-qdlqgscgd6

  • MD5

    863d4e0cab90ec8f20290da01e12cfee

  • SHA1

    6faf5098fdbc081bc0e479c33d13e3391b3c7ead

  • SHA256

    34c899b4970c2fc2cab0ddc1d4d6b4ac8181b0cdf71cd3832e1b817b8e1930d4

  • SHA512

    55ef81984f2e87c32a172dadd18bcbc9ed989e13670915a61d1fceacd87b58dd9aa515167013045f98e8c739d7ec04b51271b1d0941b444b29c8ee4dcad3fbcf

  • SSDEEP

    768:G3SOA2NuHRZ94EnzsbQU4YNaFAVVnSIW0vE:p/940zSEYNNVVtW0vE

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\Readme.txt

Ransom Note
Your system has been encrypted by our team, and your files have been locked using our proprietary algorithm ! * Please read this message carefully and patiently * * If you use any tools, programs, or methods to recover your files and they get damaged, we will not be responsible for any harm to your files ! * Note that your files have not been harmed in any way they have only been encrypted by our algorithm. Your files and your entire system will return to normal mode through the program we provide to you. No one but us will be able to decrypt your files ! * To gain trust in us, you can send us a maximum of 2 non-important files, and we will decrypt them for you free of charge. Please note that your files should not contain important information. Your files should be in a format that we can read, such as .txt, .pdf, .xlsx, .jpg, or any other readable format for us. Please put your Unique ID as the title of the email or as the starting title of the conversation. * For faster decryption, first message us on Telegram. If there is no response within 24 hours, please email us * Telegram Id : @wing_ransomware_test Mail 1 : [email protected] Mail 2 : [email protected] You will receive btc address for payment in the reply letter -------------------------------- ! Important ! Please do not waste the time and do not try to deceive us , it will result only price increase! Please note that we are professionals and just doing our job ! We are always opened for dialog and ready to help you ! UniqueID: VYWK5UCZTHIX PersonalID: NkkIrF3a8jxLy2tsVFnCF9WYFPXSMBnWvA16WuX3j+LCuw2B0NtazYBibBa2W0UgRHWaajyfB4WWt+3DnAyl7TTRciFh1X+wjGpIw9rqqGFOYTz4JP/1/uhF1VpqOWaBZDv7l0BBxp+MrxzT9wFfKGDfvzH5QWZh72aQk4k/WyXF3sZX96oaHsIHtzCjeds7fxN0pNWfM+1PB9JswL45pYPOlm9Rdpc6cuxDrNZRXvlz3V1WYfv2qnp3X1Vm9AOLdmhXvjIhEB4bjoVRPFX8zcOzpMmeeSU/aqMllTeClQs4TZFog5er4VhgWF+sBQ52S1/7eJvcnbh2wX8zo+fJD/AaWA0xcuanRw24ek5bkCndYDVPRa503RVqC1yB57yrJf0n4igFDFcUJ3kS0jnHcexLe0qXStEwnsdsUe/5sorqkt2ZeYzCJ11hy+V7E8Ww+Jbe5S1ad/1zkZV0vydLTZtvfvzWbKYvSaNSlZFRZhWAno13DCN4NKHK50qsY/HZSYqouQcpLQuvdtYx0sWHf+L3emLi4soUK4jTUU8/kZ8QERjNjjmfQr8oWxdtbezzFWP5042KJa9qgJnwzhVNH5Tv5GKzHZe/WzFqvpo6JAByNx7sQWUY+VBfMMy21VeWoVQZi0A1ittdIAv3Rq0m0YPK+68+BjwLGwV39uqpQSs=

Targets

    • Target

    • Size

      120KB

    • MD5

      863d4e0cab90ec8f20290da01e12cfee

    • SHA1

      6faf5098fdbc081bc0e479c33d13e3391b3c7ead

    • SHA256

      34c899b4970c2fc2cab0ddc1d4d6b4ac8181b0cdf71cd3832e1b817b8e1930d4

    • SHA512

      55ef81984f2e87c32a172dadd18bcbc9ed989e13670915a61d1fceacd87b58dd9aa515167013045f98e8c739d7ec04b51271b1d0941b444b29c8ee4dcad3fbcf

    • SSDEEP

      768:G3SOA2NuHRZ94EnzsbQU4YNaFAVVnSIW0vE:p/940zSEYNNVVtW0vE

    • Renames multiple (8819) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v15

Tasks