General

  • Target

    VirusShare_7263864b3ff85cdf8f4f58ba64a5ba31

  • Size

    364KB

  • Sample

    240610-nrvt7shh89

  • MD5

    7263864b3ff85cdf8f4f58ba64a5ba31

  • SHA1

    b4d82b021896c4c9af8ab6cf61423ea845f74601

  • SHA256

    8fef8a2b184c918e92c862b9b6a42973c88528b79ec56836d3fc4f2086b1deb5

  • SHA512

    cc23d8141e75417361aea5b6916326c8abf445d99b3cedf514ca4569f8ba528e45c3d5f2bf31f376b04dacea541ab218649967b49465bc9a60386e88f94c9ab8

  • SSDEEP

    6144:hlqOZ/f3sN9020oeXa1JFhUBztIPCtrL7N0HVteM5XkIUAiFN8o2oJVz:3qOVf3s303UFyBzyPCV7O1tBFAAcNFj

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\+-xxx-HELP-xxx-+dwlnn-+.txt

Ransom Note
---------------------------------------------------- NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA-4096 https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? It means that on a structural level your files have been transformed . You won't be able to use , read , see or work with them anymore . In other words they are useless , however , there is a possibility to restore them with our help . What exactly happened to your files ??? *** Two personal RSA-4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key , which you received over the web . *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. What should you do next ? There are several options for you to consider : *** You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or *** You can start getting BitCoins right now and get access to your data quite fast . In case you have valuable files , we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions , please access your personal homepage by choosing one of the few addresses down below : http://9hrds.wolfcrap.at/D6C52C3E4BB19CFA http://6g4ds.froekuge.com/D6C52C3E4BB19CFA http://vewrb.italisumo.at/D6C52C3E4BB19CFA If you can't access your personal homepage or the addresses are not working, complete the following steps: *** Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en *** Install TOR Browser and open TOR Browser *** Insert the following link in the address bar: k7tlx3ghr3m4n2tu.onion/D6C52C3E4BB19CFA *** Follow instructions on your screen !!! *** *** *** *** *** *** *** IMPORTANT INFORMATION *** *** *** *** *** *** Your personal homepages http://9hrds.wolfcrap.at/D6C52C3E4BB19CFA http://6g4ds.froekuge.com/D6C52C3E4BB19CFA http://vewrb.italisumo.at/D6C52C3E4BB19CFA Your personal homepage Tor-Browser k7tlx3ghr3m4n2tu.onion/D6C52C3E4BB19CFA Your personal ID D6C52C3E4BB19CFA
URLs

http://9hrds.wolfcrap.at/D6C52C3E4BB19CFA

http://6g4ds.froekuge.com/D6C52C3E4BB19CFA

http://vewrb.italisumo.at/D6C52C3E4BB19CFA

http://k7tlx3ghr3m4n2tu.onion/D6C52C3E4BB19CFA

Extracted

Path

C:\Program Files\7-Zip\Lang\+-xxx-HELP-xxx-+cvbhp-+.txt

Ransom Note
---------------------------------------------------- NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA4096. Use the link down below to find additional information on the encryption keys using RSA-4096 https://en.wikipedia.org/wiki/RSA_(cryptosystem) What exactly that means? It means that on a structural level your files have been transformed . You won't be able to use , read , see or work with them anymore . In other words they are useless , however , there is a possibility to restore them with our help . What exactly happened to your files ??? *** Two personal RSA-4096 keys were generated for your PC/Laptop; one key is public, another key is private. *** All your data and files were encrypted by the means of the public key , which you received over the web . *** In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. What should you do next ? There are several options for you to consider : *** You can wait for a while until the price of a private key will raise, so you will have to pay twice as much to access your files or *** You can start getting BitCoins right now and get access to your data quite fast . In case you have valuable files , we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions , please access your personal homepage by choosing one of the few addresses down below : http://9hrds.wolfcrap.at/A3FA93D18501AE http://6g4ds.froekuge.com/A3FA93D18501AE http://vewrb.italisumo.at/A3FA93D18501AE If you can't access your personal homepage or the addresses are not working, complete the following steps: *** Download TOR Browser - http://www.torproject.org/projects/torbrowser.html.en *** Install TOR Browser and open TOR Browser *** Insert the following link in the address bar: k7tlx3ghr3m4n2tu.onion/A3FA93D18501AE *** Follow instructions on your screen !!! *** *** *** *** *** *** *** IMPORTANT INFORMATION *** *** *** *** *** *** Your personal homepages http://9hrds.wolfcrap.at/A3FA93D18501AE http://6g4ds.froekuge.com/A3FA93D18501AE http://vewrb.italisumo.at/A3FA93D18501AE Your personal homepage Tor-Browser k7tlx3ghr3m4n2tu.onion/A3FA93D18501AE Your personal ID A3FA93D18501AE
URLs

http://9hrds.wolfcrap.at/A3FA93D18501AE

http://6g4ds.froekuge.com/A3FA93D18501AE

http://vewrb.italisumo.at/A3FA93D18501AE

http://k7tlx3ghr3m4n2tu.onion/A3FA93D18501AE

Targets

    • Target

      VirusShare_7263864b3ff85cdf8f4f58ba64a5ba31

    • Size

      364KB

    • MD5

      7263864b3ff85cdf8f4f58ba64a5ba31

    • SHA1

      b4d82b021896c4c9af8ab6cf61423ea845f74601

    • SHA256

      8fef8a2b184c918e92c862b9b6a42973c88528b79ec56836d3fc4f2086b1deb5

    • SHA512

      cc23d8141e75417361aea5b6916326c8abf445d99b3cedf514ca4569f8ba528e45c3d5f2bf31f376b04dacea541ab218649967b49465bc9a60386e88f94c9ab8

    • SSDEEP

      6144:hlqOZ/f3sN9020oeXa1JFhUBztIPCtrL7N0HVteM5XkIUAiFN8o2oJVz:3qOVf3s303UFyBzyPCV7O1tBFAAcNFj

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks