Resubmissions

29-09-2024 23:33

240929-3j92gswcpr 10

27-06-2024 11:48

240627-nyjqhszcne 10

20-05-2024 02:34

240520-c2m2kagc6x 10

General

  • Target

    8eb32de1ec33ffaf2add6719d3bbc2576bc468086252c12efd8b5dcc5e44699f.zip

  • Size

    812KB

  • Sample

    240520-c2m2kagc6x

  • MD5

    f7247e6e072ae9833f58beb6dde66ba1

  • SHA1

    a5fb7db4c757d641458621eaf9e8b9f37d0d83bd

  • SHA256

    8c4731c1fbf49ef59d696d72db1aa2576e422ff788c4cc65d19a916a307b8581

  • SHA512

    97d21d9fe46ae43e0d044f6694124df5550a6b2bae7b16eb62f2fc8f65b2ffedb7abe103cbc1196cd53870ba2585634ef9bcdd71db2974a035d195ff1eb2af3c

  • SSDEEP

    24576:5km2mjT4FmaXVfTR2IMucOWPECTG/aR4zjag:qmT4zX2IMuhWsCTGSRMGg

Malware Config

Extracted

Path

/var/spool/cron/atjobs/HOW TO DECRYPT.txt

Family

targetcompany

Ransom Note
Hello Your data has been stolen and encrypted We will delete the stolen data and help with the recovery of encrypted files after payment has been made Do not try to change or restore files yourself, this will break them We provide free decryption for any 3 files up to 3MB in size on our website How to contact with us: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: 69482246DA7E767130883B50 5) You will see chat, payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion If you are unable to contact us through the site, then you can email us: [email protected] Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site.
URLs

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin

http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion

Targets

    • Target

      8eb32de1ec33ffaf2add6719d3bbc2576bc468086252c12efd8b5dcc5e44699f

    • Size

      1.9MB

    • MD5

      121f43dfb68b710165ec47b2e102b50c

    • SHA1

      dffa99b9fe6e7d3e19afba38c9f7ec739581f656

    • SHA256

      8eb32de1ec33ffaf2add6719d3bbc2576bc468086252c12efd8b5dcc5e44699f

    • SHA512

      6d7d62265b852e7adfcf5903f8b7a6c3cd0329a0d95a5e1a70897775da4e77fd125ba1949c06b2386fbfccbfd713a34c6f014ba92c41d55274f34f767d38945e

    • SSDEEP

      49152:GRooXHbhpWDbkVdmAxURyLAlLcbxY9CE5r9:toXzmSURyCxx

    • TargetCompany,Mallox

      TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.

    • Creates/modifies Cron job

      Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks