General

  • Target

    17634066488.zip

  • Size

    3.1MB

  • Sample

    240606-fgxxtahh37

  • MD5

    7457c1c16c050cfc9e89725ebb4a16bf

  • SHA1

    7d9571b6328f7bf837ccbc64a4440ac2d5abdf3a

  • SHA256

    4e0ae82a30abb62e822f3070ba61c39b3af292e3914c83b236b446470b94ad9c

  • SHA512

    bfe6e8298e7d5efa2ea41965985d9812fb88a9d71f39ac831a8db655bd39faf61dae7e2375f8b8bd09f0198ad1e9ce819be2d6bede84ebeed37fdf83a93b9165

  • SSDEEP

    49152:TTuG1cS2k2L/zO/dHAEdLbRZ7srfktivyH6xLDoDtUvNHCHM4t2cLaJXyp73g8su:v1cZOVHAYNZgIwDoxOTCLayp73zsu

Score
10/10

Malware Config

Extracted

Family

agenda

Credentials
Attributes
  • company_id

    24BSDin-W_

  • note

    -- Qilin Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from you system/network If you refuse to communicate with us and we do not come to an agreement, your data will be published. Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials-- Credentials Extension: 24BSDin-W_ Domain: 4pen4sc3leywcd4qof2ytyngjqoltib6vutcrjvaxevtmofdjsrsw4qd.onion login: f2nONLjvh-liHP-kArAZKegtTfTVF6W_ password:

rsa_pubkey.plain

Targets

    • Target

      8e1eb0ad22236e325387fdb45aea63f318a672c5d035a21d7b3a64eeafb4c5a2

    • Size

      5.0MB

    • MD5

      d67303ba66bcb4dd89de87c83f3f831f

    • SHA1

      34bfe0c8aa61f90ca03b7e80271d5a8afae0be4b

    • SHA256

      8e1eb0ad22236e325387fdb45aea63f318a672c5d035a21d7b3a64eeafb4c5a2

    • SHA512

      93380d0007c08c96f8431a2958af4c64416de1250d8f836b1f6fda62a3dba908229c272e1db31a7e1d56797a5bde44c538edf417d353d08dc89caf77c17a29df

    • SSDEEP

      98304:pJ5JuBHJK8oXqPVEjp5AT/GNZcGeKz3ZRBTum3p2n31RJ:pJqg8oaEy/mOGN3shRJ

    Score
    10/10
    • Agenda Ransomware

      A ransomware with multiple variants written in Golang and Rust first seen in August 2022.

MITRE ATT&CK Matrix

Tasks