General
- Target faef0354ee5f7c458afa16423e9ab04d.bin
- Size 41.4MB
- Sample240317-ffz1saef65
- SHA256 2eaccf2ffad0c83282b940b5ed1e65f38acacc9e002b48e3bf4f852e1097232a
Malware Config
Extracted
-
sodinokibi
-
$2a$10$hIPnYTfL4yAd01j./DIPs.Tdwq.QURm2fbUM4pQFInKQ45tak6xW6
-
5891
-
notmissingout.com
-
employeesurveys.com
-
delchacay.com.ar
-
sw1m.ru
-
sofavietxinh.com
-
samnewbyjax.com
-
pawsuppetlovers.com
-
panelsandwichmadrid.es
-
frontierweldingllc.com
-
antenanavi.com
-
nokesvilledentistry.com
-
partnertaxi.sk
-
tomaso.gr
-
levihotelspa.fi
-
myhealth.net.au
-
midmohandyman.com
-
kirkepartner.dk
-
zewatchers.com
-
lapmangfpt.info.vn
-
purposeadvisorsolutions.com
-
net
false
-
pid
$2a$10$hIPnYTfL4yAd01j./DIPs.Tdwq.QURm2fbUM4pQFInKQ45tak6xW6
-
prc
firefox
oracle
visio
xfssvccon
steam
winword
mspub
isqlplussvc
ocssd
ocautoupds
mydesktopqos
outlook
dbeng50
sql
agntsvc
tbirdconfig
encsvc
thebat
synctime
onenote
mydesktopservice
thunderbird
excel
powerpnt
dbsnmp
sqbcoreservice
ocomm
infopath
wordpad
msaccess
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
5891
-
svc
veeam
vss
backup
sophos
svc$
mepocs
memtas
sql
Extracted
-
C:\Users\Admin\README.10121048.TXT
-
darkside
- ----------- [ Welcome to DarkSide ] -------------> What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted. We use strong encryption algorithms, so you cannot decrypt your data. But you can restore everything by purchasing a special program from us - universal decryptor. This program will restore all your network. Follow our instructions below and you will recover all your data. Data leak ---------------------------------------------- First of all we have uploaded more then 90 GB data. These files include: Finance data Insurance data Buchgalting Data Banking data and details, bank contracts, creditors info Much personal data Marketing data Production, Technik data Email conversations dump and more others. All documents are fresh (last 365 days) and stored on our offline servers. All data will be published piece by piece. First data pack will be published in 7 days if we do not come for agreement. Your personal leak page: http://darksidedxcftmqa.onion/polifilm/AWeu5Sv7zTTCTjZD8YkgoPRznfE5r7G-vbsXok9EvfiaNL_eDwRlgRMruMHisnEF On the page you will find examples of files that have been stolen. The data is preloaded and will be automatically published if you do not pay. After publication, your data will be available for at least 6 months on our tor cdn servers. We are ready: - To provide you the evidence of stolen data - To delete all the stolen data. What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. How to get access on website? ---------------------------------------------- Using a TOR browser: 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://darksidfqzcuhtk2.onion/2AHUVJ3VGS97NUG5J5EYMQM5PJO77V9V0GDT3UYIJGFZUTOQRLUX593CQ2EZ2ZEH When you open our website, put the following data in the input form: Key: rIzr2nCuqbQL7MGMwoppaucqSp5AZufUiYhssYa1SGfO0XFf09fBDlLDWgKQSnnvIAfqYTsOgUhOTxzbxGsC9nH0yk2HOFhn7t8ntX8L0evyce8vKdgUKF7Xvjn6ljaQQ4HPEfPZFP2jvN0DgBVWl2WgNT1U3owZ1bNBjps34t33ObZc01Ce1yKx5CSlwUYbw1ktjqt5d7R9DwRL3NIGrTHvMX3qXI5aBAUnirnc4zHtfGPXq4CuFoh04Tv7VE81aohfvuz8D7wo7i28sbILoJyF6mzeQwSkAXolOhXKQAEPsGcdbfLxfY5uILkHB3d1gAyxT1owQXsY4heNQbY3yYL1Em7dDaLdbNhOf0adYWFiFfAl9EwLDRT96L9Xzsk17ho1B82wOWZ79ZqtT8yqnZ4APJb1LO91ASSsgUdNvR0lAaZTfXHHxUI1vDm5ygyV7cbxMlrQ5K1U6ughdd5WosogMJWVNjreirhzuDzY6SnixtukGYG0D9azzgOHcgidJcLV4n0orhzIaA1SMNYOpdOIadgBehCaHwEyr3hn8CEa6fgpUgK6E95 !!! DANGER !!! DO NOT MODIFY or try to RECOVER any files yourself. We WILL NOT be able to RESTORE them. !!! DANGER !!!
-
http://darksidedxcftmqa.onion/polifilm/AWeu5Sv7zTTCTjZD8YkgoPRznfE5r7G-vbsXok9EvfiaNL_eDwRlgRMruMHisnEF
-
http://darksidfqzcuhtk2.onion/2AHUVJ3VGS97NUG5J5EYMQM5PJO77V9V0GDT3UYIJGFZUTOQRLUX593CQ2EZ2ZEH
Extracted
-
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\DECRYPT_YOUR_FILES.HTML
- <html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>cEMvmbtz5IQ+qoxRFRsGSPwjOMo/s+x1B7TV8GLr2JviqHPSkSP7hPJiasy2BA0ZZy8XuNaUtgpUWyWD3Pbjz6kzF4xCAE8xxPril+PT/X8k2yM1SEVCJxj63fkB9b4fakcWc2Kzqv4v2Imi3Rf6PPGLRs3ddzWAqb6G6MpfRPNRYasEjtGd2On5giXgBNEISZexketEbHpkI8n8IAxt05YhdhxVAXxM0Aabe2PM4bxHpFh/iiF/25p1C93hF1t7oJouCS4h0dYWdTLUosgdNhPfg5kTdREkL5yPIzrU1NJiMNZ5LXgVjJlGyxicTiwL20lYGDiiOg2dxPNxPVTHPQ==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>
Extracted
-
C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML
- <html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>Y0OHRggYJLzItzRyw3Ap9cZ46x5Gxb0ZhqSlmZbObVPC7hoUtxk0nocqPwnHVThCxEaIwAza4iP1leOM/7aM1t5IFInSB4oqyWGYSUsWBZzevxGMhQ6IAQTVkPbuaeTI5E+WE1nDZCpSb63MCRJ5+G4gQ3CiJsKNW3LLUeQQ14UnaLspwBoufv2nsPpeGrOH2lobyUG+gG8CmxuQOxco6gLrRHj5KQ573q844LdkTOpgm+isTvryfosuN54o87IoOmS8N36tAkGOzCz/C59pL+KqBYuZsla6iS4lJRWLI7fI9GtpX4CqwH7fDy11Nmb5xPjtdb2I7Zn9BVAythBzHw==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>
Extracted
-
C:\Users\IOBAQVGLBM-DECRYPT.txt
- ---= GANDCRAB V5.0.3 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE WILL BE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .IOBAQVGLBM The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/ca9757c352489102 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAJBcKjRuN7tUl/c1k/pAhTctoo2jPGkP/1LJq18R9VdhbR0NOcelJN4+1r07hp5yDg60+IHBEJEhqMvFKENaYtkdAUU6YDQd86PYLjytJlbu4PxUdYAVNcswdgt8pZpbgeej3qpqZ8FbGX48j5sKOChSZQdFWHp/bDWgsEEc2l8lbMmTta1Qk+qPN2RtJ3V0ISbeC6JYwAGtcbpdZ57n2NfwLPXaNmyAaoV4f6iKmdCZdGRl93bC5ppHfNKATzRImFMlDI1DRUeuSZeOOZQichwbdJu3XGWajQBhhgS7bXgr2ePEjryfibfr9DfEC+EJRzaoJw8lMxhIUX+Fq0iKQxIZLJ/Q39iy6xdCY3bMPZZTQxX/OCwGcgDbErFARWxl7X00LI1tgnP+VTmV2VE/8vjR0zkWPyIa5xSVs51UyuB8vzWc1vcJoCnnBR5atDepkHP8NBliNZONHRtl/2dK+06UCDMgi73wjmDBpeRdo4/YX0fcUvIxEw4o0Tqa1gCAQ4fRU15Pzozc5b/OpLcUo5IkLtdPeVKf29eNmOgOsjeOiAaT7X0zb0xQtyr1qERObmIMpNs3ammC/s36GWZZCB73cLcp/x5us1VyO4ISKY8pyYGQnAQRBU2JyHabw75ycVfPAihTesyh13BDjEhDSVzpcu0BK/CIV0zkH+9OYfxoXPuKUaPgYPb6DLlFUb0YxIHAIqwrIYNJ52765GldnRGcNNtzGDrArj7IFhySIp540GC6GoR4GbY08qbFSozYrMtyLAQTbPA5s4nQUrUxyDmnaw36Y7DNumu/NhogtnMQx7rSkR3wiLN0W54zIsAw6WXKvQ5Ua3eHx6tfyCMKhuu6P7kQrnaeEziVGf273GN2Z690U9Vo6rvvDgYGZHwHdHpS5Ic71Ay2L50zvn4apIWQ/bqunaaf86wkyeC1SfIBzHdOFtb0AgHWsEwq4M0qNgAjOqtpAHXaXYSiZBtN2MnoEnOuZe5DC/ckz0EyrOcNn/C57J6+TrTHYr++ky0GN7b/XVIm+hxjzUsIz5Yob3KG5hqzjJrlcOyvJ8KvTV219qUzW73FAFV6TJUU8Sv+jZcNckeiE9Do4e0UFZb5zdazI2JAIb32DE0knLJZd5nsG+5pXO9gdebs5OcH7ZIITN+Hu9eomhTg29ZIoQc+QJaZU+WfUJjIOMcrBjueyGpVCyiaHuNgOOM1fgDjoGADUWkPU+Pw5mVFXnxzxuoyhXohvqAzRIzsgyHZoEEci0W4tAe9UtpYeU8bHrlkH4vuKG/ME5dc28pvwQzvcWRxbKNL+LzWTfaCj6uzghrKVNpXlgyJvO1hy7Tje7e9EOevbjzqhB4dV11qslQnBVxwSpNYVFDlnDminGOfvUSgF0MBFxqL2zS16wphH4YLwNYp/dBpZyHTjsupfcULoGlSzUp8Cs/4v6yh4It3iLiLHntKFAasvcpYJK7dzYd9ivV/XJ7/xwjNYamIkr6zlq9rHbRtyYCsw+2iODYsqxZjLNLVyhQQaySFxR2JzIMsiC46/HJok4NSpDt8TwaT9TIMXsAeqDXEZlvHSJq8aeY6tJ3SBbdERn+VovCE/QyRqAF4NP3Gc/5erP+039ZD/2usplospJiyln4e/nbWaJuVivRd/NSt4nwqjQOZHt1huWlbUgRBACUDh+r81PCedVv91Ux3dpRc4/p3uryKS9JYrLyafyd+CgUqdKLz3xEf0P8Kd/ESzeSEd2i0/7TJ0O0xh/1mFQGqQdPF4JoSbHj86nvCHebmoWs5+mPSdXesEbjpBC1Iau3U1MjJMAxJjxUCK5BA1slSOkYqr6q83x42Llks5IdVzbX4gcxL1LxHphQmzRPFhrguOQwy3CEb6adFq+/5wPSvHxWFqJlxjJdROFcVe2woahk4b9jBHAdRw2uz+YBh4m1i6O45lp+kSU9qxP7sScKPp+/RzGW3u/2wZbHBCVPDoOCD5ElsA1Si7DgWFYmNwkkmoN93vhPilg39fTG8DEwVm9TiKM5ApNUe/CAhkuS5X+7pECbkKgxWuvJ8ISbWOJnv1sFnHFboHZflH1VsGZqcG8DPQ8VQj6WiqnmdizCAHrlCrOc76E6sGivmAdzuXVJ0NdFN0lEAThlUqLlfnxFPrAROt6jDEZKJ+OsPOMCdONvoVpqFU0pJqOK+HbGkQmp/sZh/abQ9HlSuf8hkLovdTd1n3z9WYSGdMtOL0Odoq2E9WXpEFdrPY8ynxONSB64= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZWTo5RuHYT7mFWs7fYTGqHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wLmpQodXZhP6M/UPrO1sZzkDbgjYlAG3g8l65nVd0/CBUxKQ7KDJYrtX0vSmnFXg/ykfgtJNiwqfCnqbr85+BisLEjkUHB5+Kh/2E2QuslGt5YblqHBi/tpBHXEdkboycE4oG4b6a1Y8ZyGoyp2Q2iuJRzTRoqGlPQJIAJppFrwNIoDBPOnKw+A+5ZALufjGEwg7NrKg3qxA9Kxg73ZifpARFN3vbLMuar1w4ZLXRgRl+KCjmo1jngAX95mSffmizzQU1nmrIqlsew6HIMVY3pdDfwfAscdcBnP3FNhn9WQ3XC06ZCEvXtdUj8BYRMbJHwHowOP7+LRYsPy4knV/fu67PJzMP9LnZDh5szqewLRaRtAf+EbjLWu+IPXpBeLdQo9FRha1KO2vpgy2mFLQkzlAtXfjb5QmECiQ== ---END PC DATA---
-
http://gandcrabmfe6mnef.onion/ca9757c352489102
Extracted
-
F:\$RECYCLE.BIN\ZVXSMBAAIR-DECRYPT.txt
- ---= GANDCRAB V5.0.3 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE WILL BE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .ZVXSMBAAIR The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/599df0f1a8c0e3e | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAEVll4ZnPjfiAiwC1RUMUf5nb4WCdnWUX7txCP22dYqIB2ApYsrAuvFH2bcoSOqgF1qoOpeMPBQSgpx4ECLJLGldQJngiahGq04IHh+LoHV810vNPgo3X5e8FH0vZJwhAr1VXkQs7Ta/fvpzAoDROC/iVW2rciA8Gv85QE0JDvNfwA6oVDFNjqoKs9NC72CBIrfk9mqgOc8tmSTKhJ1oH51wEFp3W/ABt1G+kN71cu3CSCDnzCDP6ZQmzn7eCmTy5OMx3pBBX3o6Pe8mhujbemVhrbGz7GnMMANOgx14iZZTtdK7SRGzOhGh6HMXXcQuWB/xncumgEcFMC8rlFvc3KV0n5whyV/lwWWVUjY09sVAbNVsslv4IlJETYm/mImOfwryrMetrj4b/d1+mEeS+B7lkRs0C4JX9oqnFCcqIwa2iaBwIr1qxphlFDKPWO4qB+mP03mAcWpSdKRgaYzXUXdrFKZxV2ltk07gh75mb/4NIzFTRtuM5i0E/jzFWq+RPVCn0EkTKi9vmoZuT168UNNhIC843rkMS1oaPBmNk0lqvVk9USb+nBcmO+EVD4Y7TcZ0vPSlmpQBydTiZWvE6DncvXA3Pmu0lgJi0qy9hZHs9YBxoVaM7RLFYpshCG8GODEpd2lu08PXGW2HREJGjwPWqNfpujRXEQR8jZfr1bJ933zE+U9xBXapN3DNt7fQLSZinaeMXm/r0ABg+wcY/cpLX2742IwIe6Hbimbn3cXvSNQCfRtSMwUBE4lGMuMdzqKRKDz7wpLfRxeaHS4mJ3pG8cElcTx1bSejQlcTH78yfYj4nNL7C6aQRcE2zjXqLLu85+ucZ50fNgdn9ahDblSXvHc8IjOY6Hv+kX4ALemexx/mbtN6FGjP6Lqw+GM/+U1fRN6xbHGjN433mCXkSSHGWOWPsA8hrK9V02CXPVLHKf9xDlzNGwbaVoxJZWP4KShZ/0fEyLktnnIBpZJsCu3NBTHe0kxqKGoElQ/aw3Je8xvYiAqpw6zhRUJbFRVYWEtirNu/b6AQfC6nZeLpcZFa68eJVX7dVNURxTVk8LDkGms1avydMTtFpbZMtDu3wHSvcd67DKHAvxdLUPc4gPhJRipXJJ4uyZSNLLqPE5R/5HmdASz2iay5nXJtF7x5tblfxP7U8S79rJjmNcFsVrQHd86UYMumPOmsjJUQYS9vvz0nf7CBh5UD/1cVTYzusoaR+w5C4jidi80yLgK9UKN7qOU2/5G/Rf390JPNa6BYxyY9LIXoEJoyE7JUYgz7vVbma+5A/5guNTSQfUcZN/vOZ6YdgcETbR1i1PPeokHm7oBZRtkSgNvATrpdfDeKB9XViIcYC6WzPPJeTr2w98KYtqZIGXECxs/baC5K2340flMC+HBBHZr9/E5MEjJDbwwY4ozbLBkit1KFO8akZvOIHL4951sAcZCuUKi9vuWMYRnFr9kCMCX7f9eUsjo4hZQZI/bffMqaDX5FmZuDExZNL4osbWVLvhaBXF5eq8+LGCYafuYUiJSPuEO31fNjpb7Lodk6eM8m8m63zVQu67X3baFmC+GErSORJ9xAXmzZveBN5AYXP0XIUJLHQWBC4a+piZwwuchGsqYiCznvetpWHgqIb+kOOgJf+WxJIhQcQQ2ubneNpPqiW12zMNMb7zJWbNbXnFf1krXkH6TmafvsVMt2naPLDFb0ZSsPA5311WI/WXoBw4c03/VKm022j6OjwubXHq6k2zmUzUeEVR/ztBFeVQZ/M1P+Fq91nsXeRya5HqAkEbfWCffvsMQUAQ9uA8cxWTCerntoXmKK79oJWiSh1tAV8X0HziamIrn28vhnzEaF3c7Lu+u6mMBrHK5gGWJ0sD4O1iEVvmEFRWFzMKtylhZI91El/VJii0MnmGr14Vg5FG0bJhL/qXpZ55G/tmYWiUXALYVzSdlmVuz49mGW/wzu0CaNfdNAGXZgcv6mmoAG8LrZsPyuOIhmnOe7w5xaF0G4J1N8hSc2PybWy7BnOQ1dGtR1gxBxinrnQ5pSNR7gzVG4CcmUma81b1M97K63iIhBpPmMjsqQrZMgyckrZSjs+vEesO+T6M8/+Bukx/yuHyWq2Idp3z6TATAv3+LFfALls98A2V4OyK8Uy3pP3D29XY3mQsJy+/nee0Z2E7oxLwk/LgdxQtzaZf3MD4VJYCIiklBhZpX47Hey/DakYBA7Ho0EGBkHDFBum4cu+a5EzGO1vHT3Iyt7IrOSPHM= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZTTpVRpnYM7mJWs7fSTHeHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZIP7k/TfrG1tVzlDb3jcZAB3gql9dnWN0lCD4xdg7bDNQrvH1xSi3FCw+6kfktKtizqdynr7r154JiurEmkUXB5eKt/282RetwGttYOlqCBnbtpRGFEdkb9CcR4oy4Laa5Y59yPYyu2Qiiy5RtTRYqBlPKJPYJzJFqwNcoBxPInKc+DO5cALafi2Eyg61rLg32xAxKww72ZinpCBFM3vDLMuag1wIZNHQQRkmKCjnb1ifgDX9lmT3f7CydQUtnnLIqlsiw73IGVY3pfjf3fBwceMB8P3BNg39XQ3DC2aZBEuHtLEi+BdBMOZH4HpsOeb/YRZoP4YksV8zuv7OczMv9OXYAh9gzrewdRb9tHf+DbmDW4OIcXpVeLdQr9FxhOVLL2u9gwWmeLQ4zxgtafmr5TWEPiWMEkrI= ---END PC DATA---
-
http://gandcrabmfe6mnef.onion/599df0f1a8c0e3e
Extracted
-
metasploit
-
windows/single_exec
Extracted
-
C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___Z0KRB6PH_.txt
-
cerber
- Hi, I'am CRBR ENCRYPTOR ;) ----- ALL YOUR DOCUMENTS, PH0T0S, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only one way to decrypt your files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_R_E_A_D___T_H_I_S_*) with complete instructions how to decrypt your files. If you cannot find any (*_R_E_A_D___T_H_I_S_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://xpcx6erilkjced3j.onion/ACEA-D512-C2EB-0098-B39C Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://xpcx6erilkjced3j.1n5mod.top/ACEA-D512-C2EB-0098-B39C 2. http://xpcx6erilkjced3j.19kdeh.top/ACEA-D512-C2EB-0098-B39C 3. http://xpcx6erilkjced3j.1mpsnr.top/ACEA-D512-C2EB-0098-B39C 4. http://xpcx6erilkjced3j.18ey8e.top/ACEA-D512-C2EB-0098-B39C 5. http://xpcx6erilkjced3j.17gcun.top/ACEA-D512-C2EB-0098-B39C ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----
-
http://xpcx6erilkjced3j.onion/ACEA-D512-C2EB-0098-B39C
-
http://xpcx6erilkjced3j.1n5mod.top/ACEA-D512-C2EB-0098-B39C
-
http://xpcx6erilkjced3j.19kdeh.top/ACEA-D512-C2EB-0098-B39C
-
http://xpcx6erilkjced3j.1mpsnr.top/ACEA-D512-C2EB-0098-B39C
-
http://xpcx6erilkjced3j.18ey8e.top/ACEA-D512-C2EB-0098-B39C
-
http://xpcx6erilkjced3j.17gcun.top/ACEA-D512-C2EB-0098-B39C
Extracted
-
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___K5M2_.txt
-
cerber
- Hi, I'am CRBR ENCRYPTOR ;) ----- ALL YOUR DOCUMENTS, PH0T0S, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only one way to decrypt your files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_R_E_A_D___T_H_I_S_*) with complete instructions how to decrypt your files. If you cannot find any (*_R_E_A_D___T_H_I_S_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://xpcx6erilkjced3j.onion/A112-D896-B9FC-0098-B0F1 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://xpcx6erilkjced3j.1n5mod.top/A112-D896-B9FC-0098-B0F1 2. http://xpcx6erilkjced3j.19kdeh.top/A112-D896-B9FC-0098-B0F1 3. http://xpcx6erilkjced3j.1mpsnr.top/A112-D896-B9FC-0098-B0F1 4. http://xpcx6erilkjced3j.18ey8e.top/A112-D896-B9FC-0098-B0F1 5. http://xpcx6erilkjced3j.17gcun.top/A112-D896-B9FC-0098-B0F1 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----
-
http://xpcx6erilkjced3j.onion/A112-D896-B9FC-0098-B0F1
-
http://xpcx6erilkjced3j.1n5mod.top/A112-D896-B9FC-0098-B0F1
-
http://xpcx6erilkjced3j.19kdeh.top/A112-D896-B9FC-0098-B0F1
-
http://xpcx6erilkjced3j.1mpsnr.top/A112-D896-B9FC-0098-B0F1
-
http://xpcx6erilkjced3j.18ey8e.top/A112-D896-B9FC-0098-B0F1
-
http://xpcx6erilkjced3j.17gcun.top/A112-D896-B9FC-0098-B0F1
Targets
-
- Target ransomwares/7ev3n/7ev3n.exe
- Size 315KB
- SHA256 7d373ccb96d1dbb1856ef31afa87c2112a0c1795a796ab01cb154700288afec5
Score10/10-
Modifies WinLogon for persistence
-
UAC bypass
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
- Target ransomwares/Annabelle/Annabelle.exe
- Size 15.9MB
- SHA256 716335ba5cd1e7186c40295b199190e2b6655e48f1c1cbe12139ba67faa5e1ac
Score10/10-
Modifies WinLogon for persistence
-
Modifies Windows Defender Real-time Protection settings
-
UAC bypass
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Disables use of System Restore points
-
Modifies Windows Firewall
-
Sets file execution options in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
- Target ransomwares/BadRabbit/BadRabbit.exe
- Size 431KB
- SHA256 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da
Score10/10-
BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
mimikatz is an open source tool to dump credentials on Windows
-
Executes dropped EXE
-
Loads dropped DLL
-
- Target ransomwares/Birele/Birele.exe
- Size 116KB
- SHA256 b2dcfdf9e7b09f2aa5004668370e77982963ace820e7285b2e264a294441da23
Score10/10-
Modifies WinLogon for persistence
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application
-
- Target ransomwares/Cerber 5/Cerber 5.exe
- Size 313KB
- SHA256 b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d
Score10/10-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Blocklisted process makes network request
-
Contacts a large (1095) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
- Target ransomwares/Darkside/Darkside.exe
- Size 59KB
- SHA256 17139a10fd226d01738fe9323918614aa913b2a50e1a516e95cced93fa151c61
Score10/10-
DarkSide
Targeted ransomware first seen in August 2020. Operators steal data to use as leverage.
-
Renames multiple (152) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target ransomwares/DeriaLock/DeriaLock.exe
- Size 484KB
- SHA256 4f5bff64160044d9a769ab277ff85ba954e2a2e182c6da4d0672790cf1d48309
Score7/10-
Drops startup file
-
- Target ransomwares/Fake GoldenEye/FakeGoldenEye.exe
- Size 76KB
- SHA256 2900dcc4246afc601ada049b127c4344fa917acf1689a6a4748ee72f93f503ed
Score6/10-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
- Target ransomwares/Fake PetrWrap/FakePetrWrap.exe
- Size 78KB
- SHA256 5080b576bf0a64ed0e11799e102439101b176a3bf44ff774c94357ceab975d46
Score6/10-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
- Target ransomwares/FakePetya/FakePetya.exe
- Size 55KB
- SHA256 4146805a52db2d4fdb1183bb45f0cd4d90cf184cbd0d5ec2cf370e2fa2813cd7
Score6/10-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
- Target ransomwares/Fantom/Fantom.exe
- Size 261KB
- SHA256 f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
Score10/10-
Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
-
Renames multiple (1455) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Disables Task Manager via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
- Target ransomwares/GandCrab/GandCrab.exe
- Size 424KB
- SHA256 49b769536224f160b6087dc866edf6445531c6136ab76b9d5079ce622b043200
Score10/10-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (257) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
- Target ransomwares/GoldenEye/GoldenEye.exe
- Size 254KB
- SHA256 389a7d395492c2da6f8abf5a8a7c49c3482f7844f77fe681808c71e961bcae97
Score10/10-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Executes dropped EXE
-
Loads dropped DLL
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
- Target ransomwares/Huzuni/Huzuni.exe
- Size 65KB
- SHA256 06b8827fc8494e0e7b284a8dcb704e38169347fb857e4114813a2b8db206ec2c
Score10/10-
Modifies WinLogon for persistence
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ransomwares/InfinityCrypt/InfinityCrypt.exe
- Size 211KB
- SHA256 f5d002bfe80b48386a6c99c41528931b7f5df736cd34094463c3f85dde0180bf
Score10/10-
InfinityLock Ransomware
Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.
-
- Target ransomwares/JanusPetya/JanusPetya.exe
- Size 22KB
- SHA256 68e126f148ef6f94e73222d8703d719d03558f1330711705b08b654eb95ca794
Score7/10-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
- Target ransomwares/Krotten/Krotten.exe
- Size 53KB
- SHA256 e79f164ccc75a5d5c032b4c5a96d6ad7604faffb28afe77bc29b9173fa3543e4
Score8/10-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Adds Run key to start application
-
Modifies WinLogon
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2Create or Modify System Process
2Windows Service
2Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Indicator Removal
2File Deletion
2Modify Registry
10Pre-OS Boot
1Bootkit
1