General

  • Target

    DE6_W.elf

  • Size

    2.2MB

  • Sample

    240311-wnbadsaa8y

  • MD5

    56cabcf95add39a6feb09391ccc40dcd

  • SHA1

    84c8921f18a6d7861e842e4edb9c0c96142b5f75

  • SHA256

    4e153342189a55ffed34a91f2a3f4440af1acbf7dc58135a165a06b4e657556a

  • SHA512

    d07ebf47260c3aa6307ce96de9241b1e778d446d913f0ca2165827f66020f6198f51da542d74f9cfd23edb82f3cf40b83579d0a29825493c87fe82001793b652

  • SSDEEP

    49152:mNGaixLBzuog6dUWed4u0HPH94C05PxgeZq1:mN1idhu6dUW

Malware Config

Extracted

Path

/tmp/README_TO_DECRYPT.txt

Ransom Note
Your network has been compromised! All your important data has been encrypted! There is only one way to get your data back to normal: 1. Contact us as soon as possible to avoid damages and losses from your business. 2. Send to us any encrypted file of your choice and your personal key. 3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files. 4. Pay the amount required in order to restore your network back to normal. 5. We will then send you our software to decrypt and will guide you through the whole restoration of your network. We prefer Monero (XMR) - FIXED PRICE We accept Bitcoin (BTC) - 20% extra of total payment! ============================================================================================================================ WARNING! Do not rename encrypted data. Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover. ============================================================================================================================ Contact information: In order to contact us, download with the following software: https://qtox.github.io or https://tox.chat/download.html Then just add us in TOX: D27A7B3711CD1442A8FAC19BB5780FF291101F6286A62AD21E5F7F08BD5F5F1B9803AAC6ECF9 OR Through email: [email protected] ============================================================================================================================ Your personal id: 5253413d39623962306361376639326532366336303866356661653261636136366665383a313530383a66616c7365
URLs

https://qtox.github.io

https://tox.chat/download.html

Targets

    • Target

      DE6_W.elf

    • Size

      2.2MB

    • MD5

      56cabcf95add39a6feb09391ccc40dcd

    • SHA1

      84c8921f18a6d7861e842e4edb9c0c96142b5f75

    • SHA256

      4e153342189a55ffed34a91f2a3f4440af1acbf7dc58135a165a06b4e657556a

    • SHA512

      d07ebf47260c3aa6307ce96de9241b1e778d446d913f0ca2165827f66020f6198f51da542d74f9cfd23edb82f3cf40b83579d0a29825493c87fe82001793b652

    • SSDEEP

      49152:mNGaixLBzuog6dUWed4u0HPH94C05PxgeZq1:mN1idhu6dUW

    Score
    10/10
    • Deletes itself

    • Reads EFI boot settings

      Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

MITRE ATT&CK Enterprise v15

Tasks