General

  • Target

    5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130

  • Size

    1.0MB

  • Sample

    240416-2k5mqaga8x

  • MD5

    f5eca9408d0f7e66bf8686fc6f322dea

  • SHA1

    c5d3cb9c5bf02dc74ace0b6b3dfbfc7460141a3a

  • SHA256

    5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130

  • SHA512

    76c448b50f51ce829a3f6e7bd21503c8f0a1d0b60b8e0e8d2290543fbf489a77ea8729b3b8d1591a2ef0785ba3f8e3c18cd2f8448c8907d918e16e81e65bb333

  • SSDEEP

    24576:5k/vonhpYZQMkZWPNNjZ/AQXwIsceV4+z8F0LdA9:5k/vohp6zhdZeVJnd8

Malware Config

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-3627615824-4061627003-3019543961-1000\ReadMe.txt

Ransom Note
to recover your data install telegram messenger at @secles1bot ( https://t.me/secles1bot ) (ENTER EXACT ID , avoid fake similar ids made by unknown people to SCAM you) you will talk with support using the bot , admin will be monitoring if for any reason bot is not available you can find link and id of new bot at our onion site 2kksm7oobarkoedfnkihgsa2qdvfgwvr4p4furcsopummgs5y37s6bid.onion you will need to install tor browser for onion sites ( https://www.torproject.org/download/ ) you dont need to install tor if our telegram bot is working, the bot gets banned once a while most of the time you can open link in normal browser using proxies adding .ly to the end of url : 2kksm7oobarkoedfnkihgsa2qdvfgwvr4p4furcsopummgs5y37s6bid.onion.ly ############# please be careful , some unknown people have made similar telegram ids and bots , looking like ours to get money from you , they dont have access to keys, and will only get money and ask for more, even if you send test file, they start our original bot with new telegram account , enter your encryption id and pretend to be real client(you) , get test file from us and send back to you (unfortunately we have no way to detect whether it's you (real client) or these scammers asking for test file), after you pay them , they dont pay us and dont have keys to send back , they ask you for more payments until you give up ( we always give decryptor and keys after first and only payment) our id is @secles1bot now and if banned you can find our new id in the written onion site !!!IMPORTANT !!! ENTER EXACT TELEGRAM ID AND AVOID SIMILAR IDS, otherwise you will be SCAMMED ############### you id is : 3ENFfaiP you will get two sample decryption (decoding) before any payment for free this is strong ransomware, any day you waste without paying is one business day you waste our price is reasonable,the wasted days will cost you more some notes: 1-although illegal and bad but this is business,you are our client after infection and we will treat you respectfully like a client 2-do not delete files at c:\secles , if you want to reinstall windows take a backup of the folder (dont waste time trying to get anything out of them ,they are encrypted with our public key and cant be read without our private keys)(the folder will be empty if keys were successfully sent to server),if you are giving access to anyone to play with your files before messaging us , take a backup of this folder first, some of these experts are dummies , they delete this folder thinking it will revert your encrypted files 3-do not play with encrypted file, take a backup if you want to waste some time playing with them 4-if you take a middleman do deal with us directly , take one with good reputation ,we always provide decryptor after payment and only ask for one payment , if you take a random middle man from internet he may take you money and not pay as and disappear or lie to you 5-police can't help you , we are experienced hackers and we don't leave footprints behind , even if we did police wont risk thier million dollar worth zero day exploits for catching us, instead what they do get sure of is you never pay us and you suffer loss your data 6-if some of your files don't have our extension but do not open ,they are encrypted all other files and will decrypt normally ,they just have not been renamed to get our extension 5-some unknown scammers on youtube claim to decrypt our encrypted file (they even make fake videos ), all they do is message us , claim to be the real client ( you) get free test files from us and show them as proof to you (if you message us we will tell you what the file was , unfortunately we have no way to detect whether it's these scammers or you(real client) asking for test file) ,get money from you,but they don't pay us and will not decrypt the rest of file , they will make you wait days with different reasons until you give up or if you don't they will not answer you any more ,in simple words, when they claim a lie (decrypting our files) they are already playing you will scam you , the only safe thing you can do with no risk is message us yourself ,we will answer relieve any concern you have these scammers have eve made telegram channel saying we scam and telling they decrypt our files scam and asking you to pay them (that's a lie and they have no single proof of scam and they just steal your money as told) 6-by not paying us all you do is hurt yourself, others will pay us and we will continue 7-enter exact telegram id , SIMILAR TELEGRAM IDS ARE FAKE and will scam you 8-when you search our name in the google most sites will show you just a copy pasted article , they post the same thing changing extension and readme note ,so anything you read there is bullshit , you can verify this claim by reading their other posts about other groups , it will be the exact text .. QUESTION: what is guarantee you give keys after payment: 1-we have our reputation if we dont give someone will post about us provided the evidence and proof no one will pay us 2-we have proof channel , there we post opinion of other client who have paid and got files ,we even provide contact info of some of them (only those who have agreed) after we agree on price
URLs

https://t.me/secles1bot

http://2kksm7oobarkoedfnkihgsa2qdvfgwvr4p4furcsopummgs5y37s6bid.onion

http://2kksm7oobarkoedfnkihgsa2qdvfgwvr4p4furcsopummgs5y37s6bid.onion.ly

Extracted

Path

F:\$RECYCLE.BIN\ReadMe.txt

Ransom Note
to recover your data install telegram messenger at @secles1bot ( https://t.me/secles1bot ) (ENTER EXACT ID , avoid fake similar ids made by unknown people to SCAM you) you will talk with support using the bot , admin will be monitoring if for any reason bot is not available you can find link and id of new bot at our onion site 2kksm7oobarkoedfnkihgsa2qdvfgwvr4p4furcsopummgs5y37s6bid.onion you will need to install tor browser for onion sites ( https://www.torproject.org/download/ ) you dont need to install tor if our telegram bot is working, the bot gets banned once a while most of the time you can open link in normal browser using proxies adding .ly to the end of url : 2kksm7oobarkoedfnkihgsa2qdvfgwvr4p4furcsopummgs5y37s6bid.onion.ly ############# please be careful , some unknown people have made similar telegram ids and bots , looking like ours to get money from you , they dont have access to keys, and will only get money and ask for more, even if you send test file, they start our original bot with new telegram account , enter your encryption id and pretend to be real client(you) , get test file from us and send back to you (unfortunately we have no way to detect whether it's you (real client) or these scammers asking for test file), after you pay them , they dont pay us and dont have keys to send back , they ask you for more payments until you give up ( we always give decryptor and keys after first and only payment) our id is @secles1bot now and if banned you can find our new id in the written onion site !!!IMPORTANT !!! ENTER EXACT TELEGRAM ID AND AVOID SIMILAR IDS, otherwise you will be SCAMMED ############### you id is : nPaivvEc you will get two sample decryption (decoding) before any payment for free this is strong ransomware, any day you waste without paying is one business day you waste our price is reasonable,the wasted days will cost you more some notes: 1-although illegal and bad but this is business,you are our client after infection and we will treat you respectfully like a client 2-do not delete files at c:\secles , if you want to reinstall windows take a backup of the folder (dont waste time trying to get anything out of them ,they are encrypted with our public key and cant be read without our private keys)(the folder will be empty if keys were successfully sent to server),if you are giving access to anyone to play with your files before messaging us , take a backup of this folder first, some of these experts are dummies , they delete this folder thinking it will revert your encrypted files 3-do not play with encrypted file, take a backup if you want to waste some time playing with them 4-if you take a middleman do deal with us directly , take one with good reputation ,we always provide decryptor after payment and only ask for one payment , if you take a random middle man from internet he may take you money and not pay as and disappear or lie to you 5-police can't help you , we are experienced hackers and we don't leave footprints behind , even if we did police wont risk thier million dollar worth zero day exploits for catching us, instead what they do get sure of is you never pay us and you suffer loss your data 6-if some of your files don't have our extension but do not open ,they are encrypted all other files and will decrypt normally ,they just have not been renamed to get our extension 5-some unknown scammers on youtube claim to decrypt our encrypted file (they even make fake videos ), all they do is message us , claim to be the real client ( you) get free test files from us and show them as proof to you (if you message us we will tell you what the file was , unfortunately we have no way to detect whether it's these scammers or you(real client) asking for test file) ,get money from you,but they don't pay us and will not decrypt the rest of file , they will make you wait days with different reasons until you give up or if you don't they will not answer you any more ,in simple words, when they claim a lie (decrypting our files) they are already playing you will scam you , the only safe thing you can do with no risk is message us yourself ,we will answer relieve any concern you have these scammers have eve made telegram channel saying we scam and telling they decrypt our files scam and asking you to pay them (that's a lie and they have no single proof of scam and they just steal your money as told) 6-by not paying us all you do is hurt yourself, others will pay us and we will continue 7-enter exact telegram id , SIMILAR TELEGRAM IDS ARE FAKE and will scam you 8-when you search our name in the google most sites will show you just a copy pasted article , they post the same thing changing extension and readme note ,so anything you read there is bullshit , you can verify this claim by reading their other posts about other groups , it will be the exact text .. QUESTION: what is guarantee you give keys after payment: 1-we have our reputation if we dont give someone will post about us provided the evidence and proof no one will pay us 2-we have proof channel , there we post opinion of other client who have paid and got files ,we even provide contact info of some of them (only those who have agreed) after we agree on price
URLs

https://t.me/secles1bot

http://2kksm7oobarkoedfnkihgsa2qdvfgwvr4p4furcsopummgs5y37s6bid.onion

http://2kksm7oobarkoedfnkihgsa2qdvfgwvr4p4furcsopummgs5y37s6bid.onion.ly

Targets

    • Target

      5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130

    • Size

      1.0MB

    • MD5

      f5eca9408d0f7e66bf8686fc6f322dea

    • SHA1

      c5d3cb9c5bf02dc74ace0b6b3dfbfc7460141a3a

    • SHA256

      5eeb5d3ee576daedae9f3bd64671c002a0d5b80313f78678df449b82335c1130

    • SHA512

      76c448b50f51ce829a3f6e7bd21503c8f0a1d0b60b8e0e8d2290543fbf489a77ea8729b3b8d1591a2ef0785ba3f8e3c18cd2f8448c8907d918e16e81e65bb333

    • SSDEEP

      24576:5k/vonhpYZQMkZWPNNjZ/AQXwIsceV4+z8F0LdA9:5k/vohp6zhdZeVJnd8

    • Clears Windows event logs

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Detects command variations typically used by ransomware

    • Renames multiple (9633) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • UPX dump on OEP (original entry point)

    • Creates new service(s)

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

    • Drops file in Drivers directory

    • Modifies Installed Components in the registry

    • Stops running service(s)

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v13

Execution

Command and Scripting Interpreter

1
T1059

Scheduled Task/Job

1
T1053

Persistence

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

Indicator Removal

4
T1070

File Deletion

3
T1070.004

Modify Registry

2
T1112

Impair Defenses

1
T1562

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Network Service Discovery

1
T1046

Query Registry

4
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

3
T1082

Collection

Data from Local System

1
T1005

Impact

Inhibit System Recovery

3
T1490

Service Stop

1
T1489

Tasks