General

  • Target

    17611026749.zip

  • Size

    3.1MB

  • Sample

    240606-gbygtsaf26

  • MD5

    65d3f925572be663d7e30060e5a689e8

  • SHA1

    eec6c79715c7aec0fe66d33c7884ebce933d89ec

  • SHA256

    2d77acd4c7b1cbea6844c312ada0d9b01f56a75fc240fd11a992df2011c8be92

  • SHA512

    9e96a0bc52a53c43a0ae6cc35109d63aa0a3b996147c3bcf2f170eb9b316ecb486b1dd56fe13d7dc62741cbf12785a844bee87f6015f7a01a049faad4a52ef6e

  • SSDEEP

    98304:NNp1gi/B9dz0yTXU6DsuK+M3KMIO6VWi1L0ky:NNpqi/B3Jx12KPOkG

Score
10/10

Malware Config

Extracted

Family

agenda

Attributes
  • company_id

    rVA0Ynm3YN

  • note

    -- Qilin Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from you system/network If you refuse to communicate with us and we do not come to an agreement, your data will be published. Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials -- Backup communication via mail. in case you can't access your personal account - [email protected] Credentials Extension: rVA0Ynm3YN Domain: srb6w7f4y3ldfeb6esog4ttfh4mqttwyppihwuvjsnviq6z3e52qsyqd.onion login: XQblMmOaQgsylN2zRnn2wNVae7OOuncb password:

rsa_pubkey.plain

Targets

    • Target

      aa0772fc6784799d59649654879c2b4a23919cda410bede0162751e6d6d6b558

    • Size

      5.0MB

    • MD5

      440810b008eed766f085b69b1723f54b

    • SHA1

      9692644974071cd484455e355f8d79ce8c486e20

    • SHA256

      aa0772fc6784799d59649654879c2b4a23919cda410bede0162751e6d6d6b558

    • SHA512

      99f37c6f1e31c79836427297a15292e79f3a6dcf90e128ab721bbc57ed8e0ca4ab14d662c74bbf7c9c1c6ae66fb5b772a706d0940b487289f7397d1c15ce67a9

    • SSDEEP

      98304:bMHGypxjgEqr4y5f18zKUC11G5+ovCoTUYPK7RP684:b0/Dj8fBUC1g5+ovC4BPKc84

    Score
    10/10
    • Agenda Ransomware

      A ransomware with multiple variants written in Golang and Rust first seen in August 2022.

MITRE ATT&CK Matrix

Tasks