Resubmissions

23-07-2024 13:55

240723-q8alpswflc 10

06-09-2021 06:44

210906-hhm54safa3 10

General

  • Target

    1ba5ab55b7212ba92a9402677e30e45f12d98a98f78cdcf5864a67d6c264d053

  • Size

    610KB

  • Sample

    240723-q8alpswflc

  • MD5

    deb8f4311fd52319f6168c10b626c808

  • SHA1

    f4807d71a1048d05815a09b74997f338e26ba9ff

  • SHA256

    1ba5ab55b7212ba92a9402677e30e45f12d98a98f78cdcf5864a67d6c264d053

  • SHA512

    ecb2c2630b03a07f20e993722ef9f55f5369d11afa21bec3dab59f65867849fb3596e4d3707730d2d75acd5d62e98afb1c06f2e7a80cd4f5946b51867bed9685

  • SSDEEP

    6144:vOr9ptAkuoip7RLPIZ3s3FjC4nj5ImCEb:AAkuoK7RLPIoAZEb

Malware Config

Extracted

Path

C:\Users\Admin\Documents\README.txt

Ransom Note
All your files have been encrypted !! Don't panic please ! We are here to help you. If you don't want to cooperate and hear your mind instead of our instructions, you will loose stupidly your files but even worse, we are able to kill your main windows process so you will never be able to restart your machine after. All your network may have been infected. If this is the case, note that the decryption software we will give you for one of the machine can be used on all the infected machines. That said, note also that if you don't pay, its all your machines that will get lost and kill. Fortunately, we think you are aware that we don't want this case to happens and you too. That's why to help you, we writed a list of instructions to follow if you want to restore your files. Once you completed all the instructions below, we will be able to give you the decryption software. We don't want to loose time or play with you, we guarantee that you will get that key if you complete your job. Don't be stupid !! To restore your files, you will need to pay a ransom within 62 hours or you will loose everything. The amount requested is 280 dollars. An amount you will need to pay in monero (XMR) which is a cryptocurrency like bitcoin (BTC). Our monero ID (adress where you need to send the money) is : 8AFtPnreZp28xoetUyKiQvVtwrov9PtEbMyvczdNZpBN45EUbEsrE8xYVp4NNqPrtxNjQwn3PbW3FG16EPYcPpKzMU78xN6 We encrypted your files with AES-256 encryption method. It's the strongest encryption method you can find in this world. Again, don't be stupid and pay the ransom. Its the only way to get all things to normal. Steps (instructions) to follow : Step 1 : Search localmonero in your browser search bar and click in the first result. Step 2 : Create an account. Step 3 : Search an offer (of a reliable vendor with lot of sales) that correspond to your payment method. Step 4 : Pay 280 dollars at once. Step 5 : Go into your account wallet and you'll see the amount of monero you have paid (it need to be 280 dollars). Step 6 : Send all the monero to our monero ID (adress) which is : 8AFtPnreZp28xoetUyKiQvVtwrov9PtEbMyvczdNZpBN45EUbEsrE8xYVp4NNqPrtxNjQwn3PbW3FG16EPYcPpKzMU78xN6 Please, copy-paste it carefully !! Verify if it correspond completly to the one in this text file before you send the money !! Once you send, it will take maximum 30 minutes to recieve. When, we will recieve the payment, we will send you the decryption software by email Please contact us at for help and negociation : [email protected] Thanks.

Targets

    • Target

      1ba5ab55b7212ba92a9402677e30e45f12d98a98f78cdcf5864a67d6c264d053

    • Size

      610KB

    • MD5

      deb8f4311fd52319f6168c10b626c808

    • SHA1

      f4807d71a1048d05815a09b74997f338e26ba9ff

    • SHA256

      1ba5ab55b7212ba92a9402677e30e45f12d98a98f78cdcf5864a67d6c264d053

    • SHA512

      ecb2c2630b03a07f20e993722ef9f55f5369d11afa21bec3dab59f65867849fb3596e4d3707730d2d75acd5d62e98afb1c06f2e7a80cd4f5946b51867bed9685

    • SSDEEP

      6144:vOr9ptAkuoip7RLPIZ3s3FjC4nj5ImCEb:AAkuoK7RLPIoAZEb

    • Chaos

      Ransomware family first seen in June 2021.

    • Chaos Ransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies boot configuration data using bcdedit

    • Renames multiple (211) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks