General

  • Target

    2024-02-23_ab1803812fbf7caf9c71d2794572d062_darkside

  • Size

    146KB

  • Sample

    240223-3mhreace8x

  • MD5

    ab1803812fbf7caf9c71d2794572d062

  • SHA1

    3a48fa53195abb7fa78a634d2eff430412bca952

  • SHA256

    110372c328433649abf49f1079ea0c6610770cf9b22e7f9dfd55144dffa21aa4

  • SHA512

    732bef76748e13992772eac6bd3ef178238f6e1f624d6a98f78d3b62000ebde030457c6719353df868fff2a409bad9ac319d41859ae7fec75a63156d9c919518

  • SSDEEP

    3072:l6glyuxE4GsUPnliByocWeps0VWMDt9BsrhI2:l6gDBGpvEByocWeHFDPBsr+

Malware Config

Extracted

Path

C:\VFW6UbLgG.README.txt

Ransom Note
~~~ Unlock your files! ~~ Hello, we hacked your PC and encrypted all your files. BUT!!! Fear not, you can decrypt your files and recover everything very easy, You just need to pay a smaill ammount. this is just bussiness. You pay the ransom, we give you the file to decrypt your files, and we move on. We won't attack you again, or talk to anyone about this. Send an email to [email protected] or [email protected] and talk to us. You would need to buy XMR (Monero) to make the payment, it's very easy. or follow an online guide, ask us in the email if you need help. >>>> >>>> Your personal DECRYPTION ID: 61AE999AECFE67CFFF17BF97D672F8D4 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!

Extracted

Path

C:\VFW6UbLgG.README.txt

Ransom Note
~~~ Unlock your files! ~~ Hello, we hacked your PC and encrypted all your files. BUT!!! Fear not, you can decrypt your files and recover everything very easy, You just need to pay a smaill ammount. this is just bussiness. You pay the ransom, we give you the file to decrypt your files, and we move on. We won't attack you again, or talk to anyone about this. Send an email to [email protected] or [email protected] and talk to us. You would need to buy XMR (Monero) to make the payment, it's very easy. or follow an online guide, ask us in the email if you need help. >>>> >>>> Your personal DECRYPTION ID: 61AE999AECFE67CF1B33E7E1FDC768CC >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!

Targets

    • Target

      2024-02-23_ab1803812fbf7caf9c71d2794572d062_darkside

    • Size

      146KB

    • MD5

      ab1803812fbf7caf9c71d2794572d062

    • SHA1

      3a48fa53195abb7fa78a634d2eff430412bca952

    • SHA256

      110372c328433649abf49f1079ea0c6610770cf9b22e7f9dfd55144dffa21aa4

    • SHA512

      732bef76748e13992772eac6bd3ef178238f6e1f624d6a98f78d3b62000ebde030457c6719353df868fff2a409bad9ac319d41859ae7fec75a63156d9c919518

    • SSDEEP

      3072:l6glyuxE4GsUPnliByocWeps0VWMDt9BsrhI2:l6gDBGpvEByocWeHFDPBsr+

    • Renames multiple (346) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks