General

  • Target

    739a7434533455d3b2d7926412a9ddb363c6c626185ef0efbc1dda2185f31485

  • Size

    79KB

  • Sample

    240925-xzst9asglk

  • MD5

    0ea94d0397aab45a58b0b964355515ed

  • SHA1

    a3cc337d09edfd268a7fda70525f12f2fcd34f72

  • SHA256

    739a7434533455d3b2d7926412a9ddb363c6c626185ef0efbc1dda2185f31485

  • SHA512

    8e7d25a35f78668ee3f4677009411060ff0841e22289568054299072bd278503dbc9a9a744cf076d5018bfe995f4383defbcb9d89ab86ee8216c0e40b41e2474

  • SSDEEP

    1536:AlvQSweoWGSvsHD3ryEFmIt2HGdZcL4a32FRB9SO5sxTJhI7zJuqhZj7/:OQesnyEKHGjETirf5s7hU4EZ//

Malware Config

Extracted

Path

C:\Program Files\7-Zip\!!readme!!!.txt

Family

underground

Ransom Note
The Underground team welcomes you! We would like to inform that your network has been tested by us for vulnerabilities. Poor network security could cause your data to be lost forever. Your files are currently encrypted, they can be restored to their original state with a decryptor key that only we have. The key is in a single copy on our server. Attempting to recover data by your own efforts may result in data loss. It is important not to change their current state. Each file additionally has a unique cipher, which you can restore only with our help. We also examined your infrastructure and downloaded the most sensitive data. The list of hosts from which the information was downloaded: - 172.16.10.77 (NBA230.tpa.local) - 172.16.10.51 (SBAFS02.TPA.LOCAL) - 172.16.10.75 (NBA191.tpa.local) - 172.16.10.85 (NBA235.tpa.local) - 172.16.10.87 (NBA254.tpa.local) - 10.10.10.30 Synology (access via OpenVPN 46.29.3.77:1194) ---------------------------------- -email communications with clients that contain confidential agreements -accounting and tax reports for each client -audit documents -companys and clients financial documents -clients passports/ID's and private information -documents contain privileged and confidential information -password-protected documents from a bank -payroll data -company financial and performance data -employees personal information (Tc Identification Numbers) The total amount of downloaded information more than 200 Gb If you do not contact us within 3 days, or we cannot reach an agreement, all data will be published on a site that no one can block. Confidential data can be helpful for your competitors, enemies and darknet market hackers from over the world. The consequences will be unpredictable and the process cannot be stopped. Information about data leaks is bound to get into the media. Your company's reputation will be damaged. We value and respect every business, including yours. Therefore, we suggest you avoid further negative consequences and return to your work as soon as possible. We guarantee a fair and confidential deal in the shortest possible time. You will not only receive a decryptor, but also a description of your network vulnerabilities and information security recommendations. If necessary, you will be provided with qualified data recovery assistance. You can trust us! Reputation is important to everyone. As a proof of our statements, we are ready to restore some files for free and demonstrate how our product works. Best regards, Underground team ! Contacts for communication via chat: login to your account (Tor Browser) http://undgrddapc4reaunnrdrmnagvdelqfvmgycuvilgwb5uxm25sxawaoqd.onion/ your login: TPA your password: 7knCN#zQo@zuDZi your ID: dc6cb895e1681c716fcbbea57a8417a2
URLs

http://undgrddapc4reaunnrdrmnagvdelqfvmgycuvilgwb5uxm25sxawaoqd.onion/

Targets

    • Target

      d4a847fa9c4c7130a852a2e197b205493170a8b44426d9ec481fc4b285a92666

    • Size

      146KB

    • MD5

      059175be5681a633190cd9631e2975f6

    • SHA1

      fb4ad5d21f0d8c6755eb4addba0ac288bd2574b6

    • SHA256

      d4a847fa9c4c7130a852a2e197b205493170a8b44426d9ec481fc4b285a92666

    • SHA512

      3a6c7667161ad9122785b6ef988d59f473b517e32e93c786c6a551d4c631f0ca82de1d262a056928935f05aa6723a7fe983158011e53042743194899c3e912e7

    • SSDEEP

      3072:sdjFOoTVq4m0zRilymyU3pQuz1T5SKiVi6:4M2ZmEoL3Cu6K

    • Underground Team

      Underground Team is a ransomware first seen in July 2023 that is primarily distriuted via exploting vulnerabilities.

    • Clears Windows event logs

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops desktop.ini file(s)

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

MITRE ATT&CK Enterprise v15

Tasks