General

  • Target

    2024-02-14_aa35558f6a0800d0e1fd30cde4b9974b_adload_evilquest

  • Size

    11.6MB

  • Sample

    240214-egtdysgc9t

  • MD5

    aa35558f6a0800d0e1fd30cde4b9974b

  • SHA1

    c3f422433d5bf4bfe1ee65b91cf2b0c9194c53dd

  • SHA256

    212b8014273666a51ead8380acc695114c481045fc4de2b5a9a04881380e6f28

  • SHA512

    5d69679b3bb0909efae387eccf99d19185c1c405cc5e977e56ad46b868d2aaf6e7f64a867d20c61b0a7add66957f031d37c240ce6570253977e7874bc55fe485

  • SSDEEP

    49152:U33dQ33g833E33dQ33g8u33dQ33g833E33dQ33g8133dQ33g833E33dQ33g8u33J:X

Malware Config

Extracted

Path

/Users/run/Desktop/READ_ME_NOW.txt

Ransom Note
YOUR IMPORTANT FILES ARE ENCRYPTED Many of your documents, photos, videos, images and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for a way to recover your files, but do not waste your time. Nobody can recover your file without our decryption service. We use 256-bit AES algorithm so it will take you more than a billion years to break this encryption without knowing the key (you can read Wikipedia about AES if you don't believe this statement). Anyways, we guarantee that you can recover your files safely and easily. This will require us to use some processing power, electricity and storage on our side, so there's a fixed processing fee of 50 USD. This is a one-time payment, no additional fees included. In order to accept this offer, you have to deposit payment within 72 hours (3 days) after receiving this message, otherwise this offer will expire and you will lose your files forever. Payment has to be deposited in Bitcoin based on Bitcoin/USD exchange rate at the moment of payment. The address you have to make payment is: 13roGMpWd7Pb3ZoJyce8eoQpfegQvGHHK7 Decryption will start automatically within 2 hours after the payment has been processed and will take from 2 to 5 hours depending on the processing power of your computer. After that all of your files will be restored. THIS OFFER IS VALID FOR 72 HOURS AFTER RECEIVING THIS MESSAGE
Wallets

13roGMpWd7Pb3ZoJyce8eoQpfegQvGHHK7

Targets

    • Target

      2024-02-14_aa35558f6a0800d0e1fd30cde4b9974b_adload_evilquest

    • Size

      11.6MB

    • MD5

      aa35558f6a0800d0e1fd30cde4b9974b

    • SHA1

      c3f422433d5bf4bfe1ee65b91cf2b0c9194c53dd

    • SHA256

      212b8014273666a51ead8380acc695114c481045fc4de2b5a9a04881380e6f28

    • SHA512

      5d69679b3bb0909efae387eccf99d19185c1c405cc5e977e56ad46b868d2aaf6e7f64a867d20c61b0a7add66957f031d37c240ce6570253977e7874bc55fe485

    • SSDEEP

      49152:U33dQ33g833E33dQ33g8u33dQ33g833E33dQ33g8133dQ33g833E33dQ33g8u33J:X

MITRE ATT&CK Enterprise v15

Tasks