General

  • Target

    VirusShare_41fb9932be35e9e5ea61d74f8517c748

  • Size

    222KB

  • Sample

    240610-nfskpshd34

  • MD5

    41fb9932be35e9e5ea61d74f8517c748

  • SHA1

    69330b95b02db41a23198f164af47a151556e863

  • SHA256

    e0aea54912d5f4e793d03303151a5d83b2d9c818b5ce8fa6ea3f609a3273114e

  • SHA512

    c46c433a4cd5bd52ccf23a0d9ff705d1a8eaa123adae5b71f6f9a18a13281850af954850a074c45157dad352b0cce27b3ef6ac905d603344d3e4d86cd0b3aebc

  • SSDEEP

    6144:FiIqk2kmqtVqu1S0IaQsG8c6Ty9Av4DObk:FLqzkvBSJ+G8XySgaI

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\-!RecOveR!-wchpo++.Txt

Ransom Note
(#?0$; >/##-=." *;,!2=:+1*$9*;/ ----- (#?0$; >/##-=." *;,!2=:+1*$9*;/ (#?0$; >/##-=." *;,!2=:+1*$9*;/ ------- (#?0$; >/##-=." *;,!2=:+1*$9*;/ NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA-4096 https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? (#?0$; >/##-=." *;,!2=:+1*$9*;/ ------- (#?0$; >/##-=." *;,!2=:+1*$9*;/ It means that on a structural level your files have been transformed . You won't be able to use , read , see or work with them anymore . In other words they are useless , however , there is a possibility to restore them with our help . What exactly happened to your files ??? *** Two personal RSA-4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key , which you received over the web . *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. (#?0$; >/##-=." *;,!2=:+1*$9*;/ ----- (#?0$; >/##-=." *;,!2=:+1*$9*;/ What should you do next ? There are several options for you to consider : *** You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or *** You can start getting BitCoins right now and get access to your data quite fast . In case you have valuable files , we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions , please access your personal homepage by choosing one of the few addresses down below : http://74bfc.flubspiel.com/A68E5BBC75E03753 http://ibf4d.ukegaub.at/A68E5BBC75E03753 http://k3cxd.pileanoted.com/A68E5BBC75E03753 If you can't access your personal homepage or the addresses are not working, complete the following steps: *** Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en *** Install TOR Browser, run TOR Browser *** Insert link in the address bar: xzjvzkgjxebzreap.onion/A68E5BBC75E03753 (#?0$; >/##-=." *;,!2=:+1*$9*;/ (#?0$; >/##-=." *;,!2=:+1*$9*;/ (#?0$; >/##-=." *;,!2=:+1*$9*;/ ***************IMPORTANT*****************INFORMATION******************** Your personal homepages http://74bfc.flubspiel.com/A68E5BBC75E03753 http://ibf4d.ukegaub.at/A68E5BBC75E03753 http://k3cxd.pileanoted.com/A68E5BBC75E03753 Your personal homepage Tor-Browser xzjvzkgjxebzreap.onion/A68E5BBC75E03753 Your personal ID A68E5BBC75E03753 (#?0$; >/##-=." *;,!2=:+1*$9*;/ (#?0$; >/##-=." *;,!2=:+1*$9*;/ (#?0$; >/##-=." *;,!2=:+1*$9*;/
URLs

http://74bfc.flubspiel.com/A68E5BBC75E03753

http://ibf4d.ukegaub.at/A68E5BBC75E03753

http://k3cxd.pileanoted.com/A68E5BBC75E03753

http://xzjvzkgjxebzreap.onion/A68E5BBC75E03753

Extracted

Path

C:\Program Files\Common Files\DESIGNER\-!RecOveR!-rmooc++.Txt

Ransom Note
448)2=(,>$5);(>4(#*03'(2#1&/9?0 ----- 448)2=(,>$5);(>4(#*03'(2#1&/9?0 448)2=(,>$5);(>4(#*03'(2#1&/9?0 ------- 448)2=(,>$5);(>4(#*03'(2#1&/9?0 NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA-4096 https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? 448)2=(,>$5);(>4(#*03'(2#1&/9?0 ------- 448)2=(,>$5);(>4(#*03'(2#1&/9?0 It means that on a structural level your files have been transformed . You won't be able to use , read , see or work with them anymore . In other words they are useless , however , there is a possibility to restore them with our help . What exactly happened to your files ??? *** Two personal RSA-4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key , which you received over the web . *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. 448)2=(,>$5);(>4(#*03'(2#1&/9?0 ----- 448)2=(,>$5);(>4(#*03'(2#1&/9?0 What should you do next ? There are several options for you to consider : *** You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or *** You can start getting BitCoins right now and get access to your data quite fast . In case you have valuable files , we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions , please access your personal homepage by choosing one of the few addresses down below : http://74bfc.flubspiel.com/8CEBE358D35D2297 http://ibf4d.ukegaub.at/8CEBE358D35D2297 http://k3cxd.pileanoted.com/8CEBE358D35D2297 If you can't access your personal homepage or the addresses are not working, complete the following steps: *** Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en *** Install TOR Browser, run TOR Browser *** Insert link in the address bar: xzjvzkgjxebzreap.onion/8CEBE358D35D2297 448)2=(,>$5);(>4(#*03'(2#1&/9?0 448)2=(,>$5);(>4(#*03'(2#1&/9?0 448)2=(,>$5);(>4(#*03'(2#1&/9?0 ***************IMPORTANT*****************INFORMATION******************** Your personal homepages http://74bfc.flubspiel.com/8CEBE358D35D2297 http://ibf4d.ukegaub.at/8CEBE358D35D2297 http://k3cxd.pileanoted.com/8CEBE358D35D2297 Your personal homepage Tor-Browser xzjvzkgjxebzreap.onion/8CEBE358D35D2297 Your personal ID 8CEBE358D35D2297 448)2=(,>$5);(>4(#*03'(2#1&/9?0 448)2=(,>$5);(>4(#*03'(2#1&/9?0 448)2=(,>$5);(>4(#*03'(2#1&/9?0
URLs

http://74bfc.flubspiel.com/8CEBE358D35D2297

http://ibf4d.ukegaub.at/8CEBE358D35D2297

http://k3cxd.pileanoted.com/8CEBE358D35D2297

http://xzjvzkgjxebzreap.onion/8CEBE358D35D2297

Targets

    • Target

      VirusShare_41fb9932be35e9e5ea61d74f8517c748

    • Size

      222KB

    • MD5

      41fb9932be35e9e5ea61d74f8517c748

    • SHA1

      69330b95b02db41a23198f164af47a151556e863

    • SHA256

      e0aea54912d5f4e793d03303151a5d83b2d9c818b5ce8fa6ea3f609a3273114e

    • SHA512

      c46c433a4cd5bd52ccf23a0d9ff705d1a8eaa123adae5b71f6f9a18a13281850af954850a074c45157dad352b0cce27b3ef6ac905d603344d3e4d86cd0b3aebc

    • SSDEEP

      6144:FiIqk2kmqtVqu1S0IaQsG8c6Ty9Av4DObk:FLqzkvBSJ+G8XySgaI

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks