General

  • Target

    58c285c3df955356b0de4fd8366aafca_JaffaCakes118

  • Size

    903KB

  • Sample

    240519-f363lsce33

  • MD5

    58c285c3df955356b0de4fd8366aafca

  • SHA1

    4573f3abf225c00fddeb3ebdace7bf77bbe04b15

  • SHA256

    0b1f6d6c3d5008efd67b9eeebbea8c2e04a2fe3f9ee5db01004384c1419cc170

  • SHA512

    c6eb9f8a638f221000783451e4dc3576836a4a34d842c9e8850e2f58e0e5c82b942f31fba8f705532c6cc85057872b2a059e72b40644fdd0c64c3e4a6abb5622

  • SSDEEP

    12288:UlKC3i/930kve4tUwcuVJEb1OK4RtGIyc/ZFvRWwajB16I6WY0aMAnbfMeAoJRxI:o

Malware Config

Extracted

Path

C:\Program Files\Microsoft Office\Office14\35A0AF-Readme.txt

Family

netwalker

Ransom Note
Hi! Your files are encrypted. All encrypted files for this computer has extension: .35a0af -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, your data may have been stolen and if you do not cooperate with us, it will become publicly available on our blog. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_35a0af: sW9Q6Sja7AEKkRuAjJDDxgrtuJoTrtEa2YtOp8XWo91Z44JPk7 nYgtPks4ivs7t9SRlYmmI1zwuCf3PeRhqif53UiUZKepRTWGbS 13Hduy9Y8PjT0m4XyVpYjBK+8cBCYT8LKj/yHkQR08GzufJaox O7VU9Q6gmK9baT/l3OyUQYrzG4BF3bUEcw9j31L4oLOEXSYtI1 BSOvccvFLNEewKkzUyZ9CCPl3ahQ9agF2mVNZFKsZScggfPvZq 2Q+KsgSzxokVDJSpY64lbolZgNAGsxkjhRY9P+uQ==}
URLs

http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Extracted

Path

C:\Recovery\WindowsRE\5CF39B-Readme.txt

Family

netwalker

Ransom Note
Hi! Your files are encrypted. All encrypted files for this computer has extension: .5cf39b -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, your data may have been stolen and if you do not cooperate with us, it will become publicly available on our blog. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_5cf39b: XnHZOVZCM8ydqOVf/rzZE06EQWFL02DyKxvBnuxoTf3XFR70Sl ky/wVUDaAwDSK7ids0opEya778N5/uqUvUGk5yf6Iwx2QkWGbS 1855cmI8lkBakbxYq7pfaP+YWYnbVGns3VxNTJoPkrVZQNBIbC tlEvCPNlRJcdgAu35fMB+YyNa7OV32tS2mn5UcNSce8TU2Z1k1 Kh/1cgunCb59qpDzRVrOqEA775PckXgF+SlFAebx7XL+ssURa9 Icj9mK+XVqVIIZLj6kofhXQJtCCFEx4r8AeW27fQ==}
URLs

http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Targets

    • Target

      58c285c3df955356b0de4fd8366aafca_JaffaCakes118

    • Size

      903KB

    • MD5

      58c285c3df955356b0de4fd8366aafca

    • SHA1

      4573f3abf225c00fddeb3ebdace7bf77bbe04b15

    • SHA256

      0b1f6d6c3d5008efd67b9eeebbea8c2e04a2fe3f9ee5db01004384c1419cc170

    • SHA512

      c6eb9f8a638f221000783451e4dc3576836a4a34d842c9e8850e2f58e0e5c82b942f31fba8f705532c6cc85057872b2a059e72b40644fdd0c64c3e4a6abb5622

    • SSDEEP

      12288:UlKC3i/930kve4tUwcuVJEb1OK4RtGIyc/ZFvRWwajB16I6WY0aMAnbfMeAoJRxI:o

    • Netwalker Ransomware

      Ransomware family with multiple versions. Also known as MailTo.

    • Renames multiple (7416) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

MITRE ATT&CK Enterprise v15

Tasks