General

  • Target

    f8d13962aeee346b491d9527e1de23e438262eadd1f27ae1ab071b8bb9fbf4cf

  • Size

    94KB

  • Sample

    240328-ejkjtsbf67

  • MD5

    c3fb6eaef47d15ac602a9303b1f8b3ec

  • SHA1

    cb199a54ef6afb56622ebae472735f352c525fbc

  • SHA256

    f8d13962aeee346b491d9527e1de23e438262eadd1f27ae1ab071b8bb9fbf4cf

  • SHA512

    8e61975a25ed0aca839c5ed1f9d223742372a9196eaf36176f3fed9914a956468b335e1d687ba33752915b6267f95116a60364e446cc817ec3352832feef99c0

  • SSDEEP

    1536:p8mQfSwRDnLplcYpa9vpw+cKmnvhkCtep6+aWNwWN+hNKNdkgECg58GH4ZmF7Wmb:2s2TdlWhDSm6Zc7+NKvkgbg5cmxVXLv

Malware Config

Extracted

Path

C:\1nddzense.README.txt

Ransom Note
Hello SevenSeas! Your files (10.1.9.38-e-UsersP, 10.1.9.39-d-Chandlers, 10.1.9.38-e-DATA) have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay. Our communication process: 1. You contact us via email or Tox. 2. We send you a list of files that were stolen 3. We decrypt 3 files to confirm that our decryptor works. 4. We agree on the amount, which must be paid using BTC. 5. We delete your files, we give you a decryptor. 6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future. Recommendations: DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. Contacts: Email: LyricSullivan@proton.me Reserve: CaPorter1997@proton.me Tox: 1C054B722BCBF41A918EF3C485712742088F5C3E81B2FDD91ADEA6BA55F4A856D90A65E99D20 * If you want to contact us via Tox you need to download it from this link: https://github.com/qTox/qTox/releases/download/v1.17.6/setup-qtox-x86_64-release.exe YOUR ID: A3B3B526A8DEA90D817AE901478B8D5F If you refuse to pay or do not get in touch with us, we start publishing your files. After 7 days the email will no longer be available, and the opportunity to receive the decryptor will also no longer be available. Sincerely, 01000100 01110010 01100001 01100111 01101111 01101110 01000110 01101111 01110010 01100011 01100101
Emails

LyricSullivan@proton.me

CaPorter1997@proton.me

URLs

https://github.com/qTox/qTox/releases/download/v1.17.6/setup-qtox-x86_64-release.exe

Extracted

Path

C:\1nddzense.README.txt

Ransom Note
Hello SevenSeas! Your files (10.1.9.38-e-UsersP, 10.1.9.39-d-Chandlers, 10.1.9.38-e-DATA) have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay. Our communication process: 1. You contact us via email or Tox. 2. We send you a list of files that were stolen 3. We decrypt 3 files to confirm that our decryptor works. 4. We agree on the amount, which must be paid using BTC. 5. We delete your files, we give you a decryptor. 6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future. Recommendations: DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. Contacts: Email: LyricSullivan@proton.me Reserve: CaPorter1997@proton.me Tox: 1C054B722BCBF41A918EF3C485712742088F5C3E81B2FDD91ADEA6BA55F4A856D90A65E99D20 * If you want to contact us via Tox you need to download it from this link: https://github.com/qTox/qTox/releases/download/v1.17.6/setup-qtox-x86_64-release.exe YOUR ID: A3B3B526A8DEA90DE6B2B383F6E8AC9B If you refuse to pay or do not get in touch with us, we start publishing your files. After 7 days the email will no longer be available, and the opportunity to receive the decryptor will also no longer be available. Sincerely, 01000100 01110010 01100001 01100111 01101111 01101110 01000110 01101111 01110010 01100011 01100101
Emails

LyricSullivan@proton.me

CaPorter1997@proton.me

URLs

https://github.com/qTox/qTox/releases/download/v1.17.6/setup-qtox-x86_64-release.exe

Targets

    • Target

      0023baf38263857e32b8cdbeb25ac2e95ae25ccf082d193f187ef8fc192f930b

    • Size

      147KB

    • MD5

      9b8b1c67c3ea9880a21ee85789e22ef1

    • SHA1

      de880afad0b6f9afa30e5964e55d52146268d4f1

    • SHA256

      0023baf38263857e32b8cdbeb25ac2e95ae25ccf082d193f187ef8fc192f930b

    • SHA512

      951d710b3e3cb280fe8b726478ef4096ddeb2607ca06dd5e48009e1da0e13e75b417a7015b8cb31689b5927a12e4721376db0043085e6dfe9403f31c65d11e41

    • SSDEEP

      3072:46glyuxE4GsUPnliByocWepp/6NemuUqk8BTqQIr:46gDBGpvEByocWeTbL4d

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v13

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Collection

Data from Local System

1
T1005

Tasks