Overview

overview

10

Static

static

10

encrypt-linux

ubuntu-20.04-amd64

Sharing

Copy URL Twitter E-mail

General

  • Target
    encrypt-linux
  • Size 1.9MB
  • Sample240224-sqwsbsfd63
  • SHA256 b16f33e561e5285e2bf93bd94a213ff350cca91db6643c02a9f495618b1fa026
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
kuiperinfostealerlinuxransomware

Malware Config

Extracted

Path

  • /tmp/README_TO_DECRYPT.txt

Ransom Note
  • Your network has been compromised! All your important data has been encrypted! There is only one way to get your data back to normal: 1. Contact us as soon as possible to avoid damages and losses from your business. 2. Send to us any encrypted file of your choice and your personal key. 3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files. 4. Pay the amount required in order to restore your network back to normal. 5. We will then send you our software to decrypt and will guide you through the whole restoration of your network. We prefer Monero (XMR) - FIXED PRICE We accept Bitcoin (BTC) - 20% extra of total payment! ============================================================================================================================ WARNING! Do not rename encrypted data. Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover. ============================================================================================================================ Contact information: In order to contact us, download with the following software: https://qtox.github.io or https://tox.chat/download.html Then just add us in TOX: D27A7B3711CD1442A8FAC19BB5780FF291101F6286A62AD21E5F7F08BD5F5F1B9803AAC6ECF9 ============================================================================================================================ Your personal id: 5253413d37623031356539343338653662656430343030656566383330613331623236623a34303938 --------- Kuiper Team ------------ ;)
URLs

  • https://qtox.github.io

  • https://tox.chat/download.html

Targets

    • Target
      encrypt-linux
    • Size 1.9MB
    • SHA256 b16f33e561e5285e2bf93bd94a213ff350cca91db6643c02a9f495618b1fa026
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    infostealerransomware

    • Deletes itself

    • Reads EFI boot settings

      Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

      infostealer
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks