General

  • Target

    enc_windows_amd64.exe.bin

  • Size

    3.9MB

  • Sample

    241022-m4hvqstdpl

  • MD5

    d1cd0d1ecf05b1c49c732e7070214676

  • SHA1

    966752f12e81ffa1322da91f861fb0ee0ee771e7

  • SHA256

    0622aed252556af50b834ae16392555e51d67b3a4c67a6836b98534a0d14d07d

  • SHA512

    0034a06e2d0cdfd33795819d6a83794ed8eca02e22acd4da83fcef579ba235198e07a6bd9269022346f73e1d6e48064ea18109dfcbf340b7aaa404969dd04fa6

  • SSDEEP

    49152:ihufkf4ncUrb/TpvO90d7HjmAFd4A64nsfJeVZGmrbqqCz+Qepylb5EmBamsgNTP:iknc4ZG2qepwE+0D+q

Score
10/10

Malware Config

Extracted

Path

C:\Users\Default\Documents\HOW_RETURN_YOUR_DATA.TXT

Ransom Note
Hello! Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay. --- Our communication process: 1. You contact us. 1. We send you a list of files that were stolen. 2. We decrypt 1 file to confirm that our decryptor works. 3. We agree on the amount, which must be paid using BTC. 4. We delete your files, we give you a decryptor. 5. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future. --- Client area (use this site to contact us): Link for Tor Browser: http://panela3eefdzfzxzxcshfnbustdprtlhlbe3x2fqomdz7t33iqtzvjyd.onion/Url=ddb34da5-dce4-4b46-8f7d-4674ab38be9d >>> to begin the recovery process. * In order to access the site, you will need Tor Browser, you can download it from this link: https://www.torproject.org/ --- Recommendations: DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. --- Important: If you refuse to pay or do not get in touch with us, we start publishing your files. Ehe decryptor will be destroyed and the files will be published on our blog. Blog: http://dataleakypypu7uwblm5kttv726l3iripago6p336xjnbstkjwrlnlid.onion Sincerely!
URLs

http://panela3eefdzfzxzxcshfnbustdprtlhlbe3x2fqomdz7t33iqtzvjyd.onion/Url=ddb34da5-dce4-4b46-8f7d-4674ab38be9d

http://dataleakypypu7uwblm5kttv726l3iripago6p336xjnbstkjwrlnlid.onion

Targets

    • Target

      enc_windows_amd64.exe.bin

    • Size

      3.9MB

    • MD5

      d1cd0d1ecf05b1c49c732e7070214676

    • SHA1

      966752f12e81ffa1322da91f861fb0ee0ee771e7

    • SHA256

      0622aed252556af50b834ae16392555e51d67b3a4c67a6836b98534a0d14d07d

    • SHA512

      0034a06e2d0cdfd33795819d6a83794ed8eca02e22acd4da83fcef579ba235198e07a6bd9269022346f73e1d6e48064ea18109dfcbf340b7aaa404969dd04fa6

    • SSDEEP

      49152:ihufkf4ncUrb/TpvO90d7HjmAFd4A64nsfJeVZGmrbqqCz+Qepylb5EmBamsgNTP:iknc4ZG2qepwE+0D+q

    Score
    10/10
    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks