Overview

overview

10

Static

static

10

068ca3e92c...fd.exe

windows7-x64

10

13933403b4...77.exe

windows7-x64

10

1846c1db07...e4.exe

windows7-x64

1

1de8054e71...a1.exe

windows7-x64

9

1e754e1c7e...44.exe

windows7-x64

3

1e8e39da21...bc.exe

windows7-x64

10

26af222220...f0.exe

windows7-x64

10

2a32c84488...95.exe

windows7-x64

10

2ebb2a34dd...c6.exe

windows7-x64

10

2ecf1fe02d...35.exe

windows7-x64

10

3e04fe9f42...f1.exe

windows7-x64

10

4cefaa9c54...3e.exe

windows7-x64

9

54b45f3592...4f.exe

windows7-x64

10

691fdcdf82...48.exe

windows7-x64

3

6c743c8901...30.exe

windows7-x64

10

746ac121ae...94.exe

windows7-x64

9

7826978642...b8.exe

windows7-x64

10

85959be4cf...99.exe

windows7-x64

10

8843bafbb4...12.exe

windows7-x64

9

8f11bb9536...ae.exe

windows7-x64

9

a191d7d045...90.exe

windows7-x64

a340ef5adb...56.exe

windows7-x64

10

a3ea2c5312...9c.exe

windows7-x64

3

b68f76d17c...7b.exe

windows7-x64

9

beef7e428f...7a.exe

windows7-x64

9

c5ef104253...bb.exe

windows7-x64

9

c6f33250cd...01.exe

windows7-x64

10

d29080809a...ec.exe

windows7-x64

9

d7573284c2...f2.exe

windows7-x64

9

e5f60df786...53.exe

windows7-x64

10

fbe45ed19f...ee.exe

windows7-x64

9

fd7caea00d...93.exe

windows7-x64

9

Resubmissions

16/03/2024, 15:31

240316-sygclsfg37 10

15/03/2024, 08:15

240315-j5z9madg74 10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Pablo_Escobar_2.rar

  • Size

    8.9MB

  • MD5

    2799923ee71653dba823e69d37898d4b

  • SHA1

    cd27cd3d579b1bc12933183975a5727ea86b4656

  • SHA256

    81e301752d56ea5cc6fc5b4e188fb37ee3fbf02ed8a4691b2fd9714d4ded4299

  • SHA512

    ecbd79d8861f94e46675c9c6fb45d5279ecbca2264cf106ece8043e2b7ed6940f7abf2ced02a98b770c712133368e479d81e367e4cf9bb1c0bbbccc45ba02a62

  • SSDEEP

    196608:uKTkWXnELYZnIxF08h93tu1EMUcW1mmOm/O0nRRtknTqUp6G2:uStXELYZne0i99X6mOeVz+nRpW

Score
10/10
ransomwarelockbitgandcrabchaosmedusalockerdjvuroyalxorist

Malware Config

Extracted

Family

djvu

C2

http://spaceris.com/test1/get.php

Attributes
  • extension

    .bpsm

  • offline_id

    pu5TgkFNAS5fWQ2rCzdamsmMrE5wSlTupdTI0pt1

  • payload_url

    http://uaery.top/dl/build2.exe

    http://spaceris.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-rmxjMZAZBJ Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0626JOsie

rsa_pubkey.plain

Signatures

  • Chaos Ransomware 4 IoCs
  • Chaos family
    chaos
  • Detected Djvu ransomware 1 IoCs
  • Detected Xorist Ransomware 1 IoCs
  • Djvu family
    djvu
  • GandCrab payload 3 IoCs
  • Gandcrab family
    gandcrab
  • Lockbit family
    lockbit
  • MedusaLocker payload 1 IoCs
  • Medusalocker family
    medusalocker
  • Royal Ransomware 1 IoCs
    ransomware
  • Royal family
    royal
  • Rule to detect Lockbit 3.0 ransomware Windows payload 3 IoCs
  • Xorist family
    xorist
  • Unsigned PE 31 IoCs

    Checks for missing Authenticode signature.

Files

  • Pablo_Escobar_2.rar
    .rar
  • 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd.exe
    .exe windows:5 windows x86 arch:x86

    41fb8cb2943df6de998b35a9d28668e8


    Headers

    Imports

    Sections

  • 13933403b4b5d79da1decbc41867c842e3577bcba8ce3859f7d9b881348ad377.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 1846c1db07d4f9a3a86605e38c0be5da38074b91cfafa1a72bccc693b06346e4.exe
    .exe windows:6 windows x64 arch:x64

    9cbefe68f395e67356e2a5d8d1b285c0


    Headers

    Imports

    Sections

  • 1de8054e71f00406e617230fc22017bfd66c78b216a57cec085ca6a5cb2f24a1.exe
    .exe windows:5 windows x86 arch:x86

    a2302015856b1fdd662b0e13775ed544


    Headers

    Imports

    Sections

  • 1e754e1c7e081ae1e7701ba45c80ca4156d41d958158384a368047f3a6921044.exe
    .exe windows:5 windows x86 arch:x86

    7848011b763d00cd02658995847dd30b


    Headers

    Imports

    Sections

  • 1e8e39da21c7cf3c81528389a1e8bceac78993bfea33bfccbd0280953b5011bc.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 26af2222204fca27c0fdabf9eefbfdb638a8a9322b297119f85cce3c708090f0.exe
    .exe windows:6 windows x86 arch:x86

    1a395bd10b20c116b11c2db5ee44c225


    Headers

    Imports

    Sections

  • 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695.exe
    .exe windows:5 windows x86 arch:x86

    216df81b1ef7bc2aa8ec52bbeef137c9


    Headers

    Imports

    Sections

  • 2ebb2a34dd6633e785f67d118a8c778969e4e34d667cf554268997e13920a1c6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735.exe
    .exe windows:5 windows x86 arch:x86

    216df81b1ef7bc2aa8ec52bbeef137c9


    Headers

    Imports

    Sections

  • 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1.exe
    .exe windows:5 windows x86 arch:x86

    41fb8cb2943df6de998b35a9d28668e8


    Code Sign

    Headers

    Imports

    Sections

  • 4cefaa9c547f282b73828d5330a47d774fbf23e9cdafe1e4dc7507e9415ddb3e.exe
    .exe windows:5 windows x86 arch:x86

    41fb8cb2943df6de998b35a9d28668e8


    Headers

    Imports

    Sections

  • 54b45f35926b12f7853e4854ae1d0a233ba1817451450d9b9fdf4e9b1412024f.exe
    .exe windows:5 windows x86 arch:x86

    216df81b1ef7bc2aa8ec52bbeef137c9


    Headers

    Imports

    Sections

  • 691fdcdf828b65c056782b14d1926fad490a6ed8c7c98c5b3578949be19b4948.exe
    .exe windows:5 windows x86 arch:x86

    7848011b763d00cd02658995847dd30b


    Headers

    Imports

    Sections

  • 6c743c890151d0719150246382b5e0158e8abc4a29dd4b2f049ce7d313b1a330.exe
    .exe windows:5 windows x86 arch:x86

    d59243e057545e233bed18dcd0f74e50


    Headers

    Imports

    Sections

  • 746ac121ae024e51aa3129699cae278990cf392a661b40361d9d15b86635da94.exe
    .exe windows:5 windows x86 arch:x86

    52acd2ce9ef75b1d800d1f9954cd3c9e


    Headers

    Imports

    Sections

  • 7826978642c568f975e2b65d1575fdf92e634f7c80db2c86c9d7c8066e8955b8.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 85959be4cfb50d95faaf98c2748d06e687d1def4bca27673d497c640d2a18099.exe
    .exe windows:5 windows x86 arch:x86

    0c756c849bc7b459f78f7a5ce46cd4a7


    Headers

    Imports

    Sections

  • 8843bafbb4a43a6c7a77c62a513908d1e2352ae5f58bd8bfa6d604bc795dcd12.exe
    .exe windows:4 windows x64 arch:x64

    7c4ef15b75d09eb970ab96fa0abfa509


    Headers

    Imports

    Sections

  • 8f11bb9536cb885bc57144392bc35e19dbc0f683d57c2c423c87a9d1c6d9d0ae.exe
    .exe windows:5 windows x86 arch:x86

    52acd2ce9ef75b1d800d1f9954cd3c9e


    Headers

    Imports

    Sections

  • a191d7d045dcf61582f2257bded2734b4ca424b1cf66ff519763c1888ec83190.exe
    .exe windows:5 windows

    f86dec4a80961955a89e7ed62046cc0e


    Headers

    Imports

    Sections

  • a340ef5adb00a2bf1a0735600491ca98ac8045b57db892dedc27575a53b25056.exe
    .exe windows:5 windows x86 arch:x86

    0d4c72eca79518082f6b2512e1810693


    Headers

    Imports

    Sections

  • a3ea2c531278faee7c468c005f8bb81acf6bbde82e3afa6d421d8f29d951de9c.exe
    .exe windows:5 windows x86 arch:x86

    7848011b763d00cd02658995847dd30b


    Headers

    Imports

    Sections

  • b68f76d17c4343e1a3a709c09d37a5e069ce1aec55dcb1861b2af79cc1aef47b.exe
    .exe windows:5 windows x86 arch:x86

    52acd2ce9ef75b1d800d1f9954cd3c9e


    Headers

    Imports

    Sections

  • beef7e428f26c583dd92962cbe886f2e4286825a1637b7a427ce84139ab6307a.exe
    .exe windows:6 windows x86 arch:x86

    b6698f73aa8eb2b95b67acb6e8329fa7


    Headers

    Imports

    Sections

  • c5ef104253ed4c066104a184ab368630027831b627c043d63170ff8f89c6a2bb.exe
    .exe windows:5 windows x86 arch:x86

    52acd2ce9ef75b1d800d1f9954cd3c9e


    Headers

    Imports

    Sections

  • c6f33250cd71b939f5514170a1e7ba3d0a996a3a7bfc3156e1ae6654b55c7c01.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • d29080809ab1fb959dbab1a1168e9b136aece03c7f91f071f7283aaa445e7eec.exe
    .exe windows:5 windows x86 arch:x86

    52acd2ce9ef75b1d800d1f9954cd3c9e


    Headers

    Imports

    Sections

  • d7573284c29cf5f68bb64860f1be0a696c852678fac36f176fd88f555ed853f2.exe
    .exe windows:5 windows x86 arch:x86

    52acd2ce9ef75b1d800d1f9954cd3c9e


    Headers

    Imports

    Sections

  • e5f60df786e9da9850b7f01480ebffced3be396618c230fa94b5cbc846723553.exe
    .exe windows:4 windows x86 arch:x86

    0d5a4c77fb840a628560e02b85835ba4


    Headers

    Imports

    Sections

  • fbe45ed19fa942cc5e767acc0ef638447c4aa4b52d4900627a0a0ae71d543bee.exe
    .exe windows:5 windows x86 arch:x86

    52acd2ce9ef75b1d800d1f9954cd3c9e


    Headers

    Imports

    Sections

  • fd7caea00d7f25ea02bb9c447410659c12ca35ebbb67c95c7296e6232a08ce93.exe
    .exe windows:5 windows x86 arch:x86

    52acd2ce9ef75b1d800d1f9954cd3c9e


    Headers

    Imports

    Sections