General

  • Target

    RNSM00438.7z

  • Size

    66.5MB

  • Sample

    241025-w9xqhsshqh

  • MD5

    6aa1fd460f6a293bb4c678c6668023d1

  • SHA1

    adf38d81d249d6905dde3936972cd0b1b1ff6fab

  • SHA256

    ec32913ab37549bdee7e45ed16ab6c5ac2b52228298293fb47b86855a7a791a8

  • SHA512

    0c0c7ef472287121e65504ba4e0d91805106f8ad6555553e8742b13de854369ca61ec6aa664808266c13e0c0bcc4ae4bcfd23417cd1451447f762a58a618541d

  • SSDEEP

    1572864:S08JJ5gp1eUb7NeRCwxTUsv4DK3emG/i6Eza+9sFVB4+cXfy:S+jbsR1T+mOA6G19a

Malware Config

Extracted

Family

crimsonrat

C2

173.249.50.57

12.15.206.118

Extracted

Family

crylock

Attributes
  • emails

    [email protected]

  • ransomnote

    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <title>CryLock</title> <hta:application showInTaskBar="no" APPLICATION="yes" ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu="no" applicationname="CryLock" border="thick" contexmenu="no" scroll="no" selection="yes" singleinstance="yes" windowstate="normal" MAXIMIZEBUTTON="NO" BORDER="DIALOG" width="100" height="100" MINIMIZEBUTTON="NO"></hta:application> <script language="JavaScript"> var ud=0; var op=0xc7bf30; var zoc=0; function document.onkeydown() { var alt=window.event.altKey; if (event.keyCode==116 || event.keyCode==27 || alt && event.keyCode==115) { event.keyCode=0; event.cancelBubble=true; return false; } } function document.onblur() { alert('Attention! This important information for you!'); } function ChangeTime() { var sd = new Date('<%DOUBLE_DATETIME%>'); var dn = new Date(); if (sd.getTime()<dn.getTime()) { var dt=document.getElementById('pwr'); dt.innerHTML='<font color="red" size="5"><b>Price is raised!</b></font>'; dt.style.height=78; zoc=1; } else { var delta=sd.getTime()-dn.getTime(); delta=new Date(delta); var dd=(delta.getUTCDate()-1)+((delta.getUTCMonth())*31); var hh=delta.getUTCHours(); var mm=delta.getUTCMinutes(); var ss=delta.getUTCSeconds(); if (dd!=1) { dd=dd+' days'; } else { dd=dd+' day'; } if (hh<10) { hh='0'+hh; } if (mm<10) { mm='0'+mm; } if (ss<10) { ss='0'+ss; } var dt=document.getElementById('dt'); dt.innerHTML='<font face="monospace" color="#c2c2c2" size="4"><b>'+dd+' '+hh+':'+mm+':'+ss+'</b></font>'; } var sd = new Date('<%UNDECRYPT_DATETIME%>'); dn = new Date(); if (sd.getTime()<dn.getTime()) { var dt=document.getElementById('lctw'); dt.innerHTML='<font color="red" size="5"><b>Last chance to decrypt your files!</b></font>'; zoc=2; } else { var delta=sd.getTime()-dn.getTime(); delta=new Date(delta); var dd=(delta.getUTCDate()-1)+((delta.getUTCMonth())*31); var hh=delta.getUTCHours(); var mm=delta.getUTCMinutes(); var ss=delta.getUTCSeconds(); if (dd!=1) { dd=dd+' days'; } else { dd=dd+' day'; } if (hh<10) { hh='0'+hh; } if (mm<10) { mm='0'+mm; } if (ss<10) { ss='0'+ss; } var dt=document.getElementById('et'); dt.innerHTML='<font face="monospace" color="#c2c2c2" size="4"><b>'+dd+' '+hh+':'+mm+':'+ss+'</b></font>'; } } function getRandomArbitrary(min, max) { min = Math.ceil(min); max = Math.floor(max); return Math.floor(Math.random() * (max - min)) + min; } function Rndom() { document.getElementById("blumid").focus(); var bid=document.getElementById('blumid'); var bem=document.getElementById('blummail'); if (ud==0) { op=op-0x10; } else { op=op+0x10; } if (op<=0xc00000) { ud=1; } if (op>=0xc7bf30) { ud=0; } bid.style.backgroundColor=op; bem.style.backgroundColor=op; var xx=''; var i=0; while (i<19) { xx=xx+getRandomArbitrary(0,2); i=i+1; } if (zoc==0) { var dt=document.getElementById('rc'); rc.innerHTML='<font face="monospace" color="white" size="5"><b>'+xx+'</b></font>'; } else { if (zoc==1) { var dt=document.getElementById('rc'); rc.innerHTML='<font face="monospace" color="red" size="5"><b>Price is raised!</b></font>'; } else { var dt=document.getElementById('rc'); rc.innerHTML='<font face="monospace" color="red" size="4"><b>Price is raised!<br>Last chance to decrypt your files!</b></font>'; } } } function Start() { window.resizeTo(800,500) setInterval(ChangeTime,1000); setInterval(Rndom,100); } function copytext(s) { window.clipboardData.setData("Text",s); alert(s+' copied to clipboard'); } function Restart() { alert('Attention! This important information for you!'); } </script> <body style="background-color:#0066CC;" OnLoad="Start()"> <div id="pwr" align="center" style="position:absolute; top:10px; left:10px; width:20%; border: 2px solid #c2c2c2;"> <font color="#c7bf30"><b>Payment will be raised after</b></font> <br> <div id="dt"> <font face="monospace" color="#c2c2c2" size="4">-- days --:--:--</font> </div> </div> <div align="center" style="position:absolute; top:10px; left:170px; width:58%;"> <font face="monospace" color="white" size="4"><b>Your files have been encrypted...</b></font> </div> <div align="center" style="position:absolute; top:60px; left:170px; width:58%;"> <div id="rc"> <font face="monospace" color="white" size="5"><b>00000000000000000000</b></font> </div> </div> <div id="lctw" align="center" style="position:absolute; top:10px; left:620px; width:20%; border: 2px solid #c2c2c2;"> <font color="#c7bf30"><b>Your files will be leaked after</b></font> <br> <div id="et"> <font face="monospace" color="#c2c2c2" size="4">-- days --:--:--</font> </div> </div> <div style="background-color:white;overflow-x:hide; overflow-y:scroll; position:absolute; top:100px; left:10px; width:768px; height:320px"> Decrypt files? Write to this mails: <font face="monospace" OnClick="copytext('<%MAIN_CONTACT%>')"><b><%MAIN_CONTACT%></b></font> or <font face="monospace" OnClick="copytext ('<[email protected]>')"><b><[email protected]></b></font>. Reserve telegram <font face="monospace" OnClick="copytext('@assist_decoder')"><b>@assist_decoder</b></font>. <br> Your unique ID <font face="monospace" OnClick="copytext('[<%HID%>]')"><b>[<%HID%>] <font size="2">[copy]</font></b></font> <br> <font color="#ff0000 ">Warning! All your data was extracted and copied! If you don't contact us, it will be sold and uploaded to public sources!</font> </div> <div title="Click to copy" OnClick="copytext('[<%HID%>]')" id="blumid" style="cursor:pointer;background-color:#c7bf30; position:absolute; top:430px; left:10px; width:380px; height:20px"> <b>Your ID [<%HID%>] <font size="2">[copy]</font></b> </div> <div title="Click to copy" OnClick="copytext('<%MAIN_CONTACT%>')" id="blummail" style="cursor:pointer;background-color:#c7bf30; position:absolute; top:430px; left:400px; width:380px; height:20px"> <b>Write to <%MAIN_CONTACT%> <font size="2">[copy]</font></b> </div> </body> </html>

rsa_pubkey.plain

Extracted

Family

urelas

C2

1.234.83.146

133.242.129.155

218.54.31.226

218.54.30.235

218.54.31.165

Extracted

Path

C:\Program Files\Restore-My-Files.txt

Family

lockbit

Ransom Note
All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.top/?8C77A1CE29FCE870D9309D82AC4C6C42 | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?8C77A1CE29FCE870D9309D82AC4C6C42 This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about
URLs

http://lockbit-decryptor.top/?8C77A1CE29FCE870D9309D82AC4C6C42

http://lockbitks2tvnmwk.onion/?8C77A1CE29FCE870D9309D82AC4C6C42

Extracted

Path

C:\Users\Admin\Desktop\00438\Qpinj_readme_.txt

Family

avaddon

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .bdeAeCDaAD You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website (avaddongun7rngel.onion) and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- MjAwNC1GK2FOeHFnNFNWRHVxWVM3eWZ5RnFHcnBVV25Kcm9lTHM0QzNLSWEraktnVEorTE40Y2g1WHV3dGtpYklyOFA3SmlXcnRrTTlGUU1OTkJrVDVSMDdrZzN1U3Y2NnZqcm0zTWlGMUVjdklIZllLN3J6SGgzUk9hK3J6TThHSkx3V2x0UEpxQkZ0dVJtbHZWbmdPZis0U2lUMHRIV3JIbHB6bCt6RC9YMmhPZHM2U3JUajgya1lxMk9sYXFNK3kxcGx0MVJWRzRKMklBWWFyNE1waTZCWm5nNldFd1U1OXd2b25McDR5NlhRZGpOaU5KMS9vcXpJY0lwRTRPNzdJSjJkRXpVYVpkcFVvcWZMV3RmWG1VdjNYdmVWYUNsSEsvQmprckdVZmZqYk1ucytDK29LMVczeVRJbXhRUkZQVVhLaW5leWZlcU95d2FadFJSK0dHVnlvdUYxa2dlSHgxOWV4aFNOMmtQYVhqa2dIWlRyb0xZSitUTE5adGlGSWVNY0lRalhLNCtTQmxQQUVYRzg5UlpyZlVjYVhwSHY0UVNkQTRnMXFKeVVQdUgxSit5eXZoeWY4VVFvd1BLOXpIK0pFZklwdGw5OXpJVmhMcldYNTArMlRqek5Kd2I5S2JFVGRsclFBQ3pDTXlqaDRtVkVMbkNkNTJaZ3dsS0FTdWo2bG1OQTB0RzRHUnJDVWxwb1pteGE2OTJwZzA3M1JSMjJydmh2ZW9CeGFqakgrLzAzQWRZNWhCYWpKRy9SSWpZMjdhRStadFEyVTVOakRhT0FjNzdOWi9RVktXSFNCZVRBSVBoN0VCRWcvRTZYRE9WeHdwWFRWYXNzek9KbUZ1ZElabVp6cHJlWXUrMks1NG5mL08ydzUxQUJ5OEQ3ZC9YOTFKQ1lsSWJ5OEZLVXdZSHozb0NkYWJRKzZ5UTE1Rjl0MmFPOGxKaU12anFpbmRIYWtUdVI1Snlva3NwTEp5WXRFNThHY0FIOS92SFY2V0NkQW1sZkhSeDVVKzM1Z05rYWJ6WDhMeWFUb0luWFRiN0VqalUzbjJiLzFFalFjMU5yNjNNL3dUSlZ3ZVdEeDFJYzc0YXM2SHRyQ0lSUnVHbWdYQ2xVTUYxN044NktvWmIxa2k4NktRS0pFVUJ1RXg1VlVOc1dKNmRibEF6QnZYTjRwV2F0cU5IaWkzcTZndVF0MWRreVlobm9PZHBEZjJNVlhhYllLRnFWcmFVM1VmaHIrRzlxQVF1VDFwYjlOVWRzcXBRT05tdnlVNXIxYUlRQXVDbkdHWE1MM0pqa2ovYWsyQTZQckoxdFZGbTBNeFl2cjN0NldodFpiM091dXgwdXRWVGdYNjVpK1lKVWVSUFlVZ0w2ZHI1TTJxaFFiN253bjhDemxVSWVPaENBdzVHdkI3NHZ3SXM0YUtOWXM2L3AwUUNTRzlSS1lpL0FCdW9Lc2dGSVpEbVNZNGhFa3g5SGtsZ0JweTRVU0I2T3RNYWxiTmxhWG9GdWFCN2phd1Z3RWNnMUM3M3ROOXJiempHNzRkNWhjeldRcXI4eGlOT2R3TlNFalZCWnhFY3lGM2hqRFc4S1QxNWFwU1N1cis4cHVhTG5kanhBSHhac1VVY084U1BHaG04QWNZTFFCS3NsaDhGY3NjdVVzR1p2TzkxNS9QUDdrUGdmcXhLU0VmQmRPMUI0bGExZzFrUUFJeTRNVGpJUDltQlZZZ3JPNW5WUHNINXpndUNqTVBJSXRBY0d6K3NFQkhBUmlMYVZ4YmpsWlJmM2hlc0VENmtQQmxMMnN1T1pCTktsaGxWNUk0UGd2S2hrNTVzYmlVOWl0R2hMam9EYTFNY3lvYkM3SXRaSmZuVDBMQks1akNUUTRXdjVVbjZDSnVlY0dTSVdwbGtzWWlsK3p3Z1hpSHEzdEgwU2JiYnlWYnhNWWpURkt3Wmc3RkdjeFdJVjJjc1JKWFJXbERhNHhYZHcvQlN3SEEyUHhmcFJEK1hQMG1hM0dhZTgwanFaOVg1enBTWlpZa0w0cHptREVjSldJb3JmYVFyRjh2TGhVcjlnZFVlQ05DWkVjOE1UMEQ3N0FnL1MyNFJ6NWRnd2hLVWIvSW5OeVlTOUZkTytYS25Bc21jR2dOTmJHeGNQV3hZMkJyenQ4NlZ4aUxZM2tudz09 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * l
URLs

http://avaddongun7rngel.onion

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Documents\Qpinj_readme_.txt

Family

avaddon

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .bdeAeCDaAD You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website (avaddongun7rngel.onion) and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- MjAwNC1GK2FOeHFnNFNWRHVxWVM3eWZ5RnFHcnBVV25Kcm9lTHM0QzNLSWEraktnVEorTE40Y2g1WHV3dGtpYklyOFA3SmlXcnRrTTlGUU1OTkJrVDVSMDdrZzN1U3Y2NnZqcm0zTWlGMUVjdklIZllLN3J6SGgzUk9hK3J6TThHSkx3V2x0UEpxQkZ0dVJtbHZWbmdPZis0U2lUMHRIV3JIbHB6bCt6RC9YMmhPZHM2U3JUajgya1lxMk9sYXFNK3kxcGx0MVJWRzRKMklBWWFyNE1waTZCWm5nNldFd1U1OXd2b25McDR5NlhRZGpOaU5KMS9vcXpJY0lwRTRPNzdJSjJkRXpVYVpkcFVvcWZMV3RmWG1VdjNYdmVWYUNsSEsvQmprckdVZmZqYk1ucytDK29LMVczeVRJbXhRUkZQVVhLaW5leWZlcU95d2FadFJSK0dHVnlvdUYxa2dlSHgxOWV4aFNOMmtQYVhqa2dIWlRyb0xZSitUTE5adGlGSWVNY0lRalhLNCtTQmxQQUVYRzg5UlpyZlVjYVhwSHY0UVNkQTRnMXFKeVVQdUgxSit5eXZoeWY4VVFvd1BLOXpIK0pFZklwdGw5OXpJVmhMcldYNTArMlRqek5Kd2I5S2JFVGRsclFBQ3pDTXlqaDRtVkVMbkNkNTJaZ3dsS0FTdWo2bG1OQTB0RzRHUnJDVWxwb1pteGE2OTJwZzA3M1JSMjJydmh2ZW9CeGFqakgrLzAzQWRZNWhCYWpKRy9SSWpZMjdhRStadFEyVTVOakRhT0FjNzdOWi9RVktXSFNCZVRBSVBoN0VCRWcvRTZYRE9WeHdwWFRWYXNzek9KbUZ1ZElabVp6cHJlWXUrMks1NG5mL08ydzUxQUJ5OEQ3ZC9YOTFKQ1lsSWJ5OEZLVXdZSHozb0NkYWJRKzZ5UTE1Rjl0MmFPOGxKaU12anFpbmRIYWtUdVI1Snlva3NwTEp5WXRFNThHY0FIOS92SFY2V0NkQW1sZkhSeDVVKzM1Z05rYWJ6WDhMeWFUb0luWFRiN0VqalUzbjJiLzFFalFjMU5yNjNNL3dUSlZ3ZVdEeDFJYzc0YXM2SHRyQ0lSUnVHbWdYQ2xVTUYxN044NktvWmIxa2k4NktRS0pFVUJ1RXg1VlVOc1dKNmRibEF6QnZYTjRwV2F0cU5IaWkzcTZndVF0MWRreVlobm9PZHBEZjJNVlhhYllLRnFWcmFVM1VmaHIrRzlxQVF1VDFwYjlOVWRzcXBRT05tdnlVNXIxYUlRQXVDbkdHWE1MM0pqa2ovYWsyQTZQckoxdFZGbTBNeFl2cjN0NldodFpiM091dXgwdXRWVGdYNjVpK1lKVWVSUFlVZ0w2ZHI1TTJxaFFiN253bjhDemxVSWVPaENBdzVHdkI3NHZ3SXM0YUtOWXM2L3AwUUNTRzlSS1lpL0FCdW9Lc2dGSVpEbVNZNGhFa3g5SGtsZ0JweTRVU0I2T3RNYWxiTmxhWG9GdWFCN2phd1Z3RWNnMUM3M3ROOXJiempHNzRkNWhjeldRcXI4eGlOT2R3TlNFalZCWnhFY3lGM2hqRFc4S1QxNWFwU1N1cis4cHVhTG5kanhBSHhac1VVY084U1BHaG04QWNZTFFCS3NsaDhGY3NjdVVzR1p2TzkxNS9QUDdrUGdmcXhLU0VmQmRPMUI0bGExZzFrUUFJeTRNVGpJUDltQlZZZ3JPNW5WUHNINXpndUNqTVBJSXRBY0d6K3NFQkhBUmlMYVZ4YmpsWlJmM2hlc0VENmtQQmxMMnN1T1pCTktsaGxWNUk0UGd2S2hrNTVzYmlVOWl0R2hMam9EYTFNY3lvYkM3SXRaSmZuVDBMQks1akNUUTRXdjVVbjZDSnVlY0dTSVdwbGtzWWlsK3p3Z1hpSHEzdEgwU2JiYnlWYnhNWWpURkt3Wmc3RkdjeFdJVjJjc1JKWFJXbERhNHhYZHcvQlN3SEEyUHhmcFJEK1hQMG1hM0dhZTgwanFaOVg1enBTWlpZa0w0cHptREVjSldJb3JmYVFyRjh2TGhVcjlnZFVlQ05DWkVjOE1UMEQ3N0FnL1MyNFJ6NWRnd2hLVWIvSW5OeVlTOUZkTytYS25Bc21jR2dOTmJHeGNQV3hZMkJyenQ4NlZ4aUxZM2tudz09 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * b9f
URLs

http://avaddongun7rngel.onion

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Music\Qpinj_readme_.txt

Family

avaddon

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .bdeAeCDaAD You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website (avaddongun7rngel.onion) and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- MjAwNC1GK2FOeHFnNFNWRHVxWVM3eWZ5RnFHcnBVV25Kcm9lTHM0QzNLSWEraktnVEorTE40Y2g1WHV3dGtpYklyOFA3SmlXcnRrTTlGUU1OTkJrVDVSMDdrZzN1U3Y2NnZqcm0zTWlGMUVjdklIZllLN3J6SGgzUk9hK3J6TThHSkx3V2x0UEpxQkZ0dVJtbHZWbmdPZis0U2lUMHRIV3JIbHB6bCt6RC9YMmhPZHM2U3JUajgya1lxMk9sYXFNK3kxcGx0MVJWRzRKMklBWWFyNE1waTZCWm5nNldFd1U1OXd2b25McDR5NlhRZGpOaU5KMS9vcXpJY0lwRTRPNzdJSjJkRXpVYVpkcFVvcWZMV3RmWG1VdjNYdmVWYUNsSEsvQmprckdVZmZqYk1ucytDK29LMVczeVRJbXhRUkZQVVhLaW5leWZlcU95d2FadFJSK0dHVnlvdUYxa2dlSHgxOWV4aFNOMmtQYVhqa2dIWlRyb0xZSitUTE5adGlGSWVNY0lRalhLNCtTQmxQQUVYRzg5UlpyZlVjYVhwSHY0UVNkQTRnMXFKeVVQdUgxSit5eXZoeWY4VVFvd1BLOXpIK0pFZklwdGw5OXpJVmhMcldYNTArMlRqek5Kd2I5S2JFVGRsclFBQ3pDTXlqaDRtVkVMbkNkNTJaZ3dsS0FTdWo2bG1OQTB0RzRHUnJDVWxwb1pteGE2OTJwZzA3M1JSMjJydmh2ZW9CeGFqakgrLzAzQWRZNWhCYWpKRy9SSWpZMjdhRStadFEyVTVOakRhT0FjNzdOWi9RVktXSFNCZVRBSVBoN0VCRWcvRTZYRE9WeHdwWFRWYXNzek9KbUZ1ZElabVp6cHJlWXUrMks1NG5mL08ydzUxQUJ5OEQ3ZC9YOTFKQ1lsSWJ5OEZLVXdZSHozb0NkYWJRKzZ5UTE1Rjl0MmFPOGxKaU12anFpbmRIYWtUdVI1Snlva3NwTEp5WXRFNThHY0FIOS92SFY2V0NkQW1sZkhSeDVVKzM1Z05rYWJ6WDhMeWFUb0luWFRiN0VqalUzbjJiLzFFalFjMU5yNjNNL3dUSlZ3ZVdEeDFJYzc0YXM2SHRyQ0lSUnVHbWdYQ2xVTUYxN044NktvWmIxa2k4NktRS0pFVUJ1RXg1VlVOc1dKNmRibEF6QnZYTjRwV2F0cU5IaWkzcTZndVF0MWRreVlobm9PZHBEZjJNVlhhYllLRnFWcmFVM1VmaHIrRzlxQVF1VDFwYjlOVWRzcXBRT05tdnlVNXIxYUlRQXVDbkdHWE1MM0pqa2ovYWsyQTZQckoxdFZGbTBNeFl2cjN0NldodFpiM091dXgwdXRWVGdYNjVpK1lKVWVSUFlVZ0w2ZHI1TTJxaFFiN253bjhDemxVSWVPaENBdzVHdkI3NHZ3SXM0YUtOWXM2L3AwUUNTRzlSS1lpL0FCdW9Lc2dGSVpEbVNZNGhFa3g5SGtsZ0JweTRVU0I2T3RNYWxiTmxhWG9GdWFCN2phd1Z3RWNnMUM3M3ROOXJiempHNzRkNWhjeldRcXI4eGlOT2R3TlNFalZCWnhFY3lGM2hqRFc4S1QxNWFwU1N1cis4cHVhTG5kanhBSHhac1VVY084U1BHaG04QWNZTFFCS3NsaDhGY3NjdVVzR1p2TzkxNS9QUDdrUGdmcXhLU0VmQmRPMUI0bGExZzFrUUFJeTRNVGpJUDltQlZZZ3JPNW5WUHNINXpndUNqTVBJSXRBY0d6K3NFQkhBUmlMYVZ4YmpsWlJmM2hlc0VENmtQQmxMMnN1T1pCTktsaGxWNUk0UGd2S2hrNTVzYmlVOWl0R2hMam9EYTFNY3lvYkM3SXRaSmZuVDBMQks1akNUUTRXdjVVbjZDSnVlY0dTSVdwbGtzWWlsK3p3Z1hpSHEzdEgwU2JiYnlWYnhNWWpURkt3Wmc3RkdjeFdJVjJjc1JKWFJXbERhNHhYZHcvQlN3SEEyUHhmcFJEK1hQMG1hM0dhZTgwanFaOVg1enBTWlpZa0w0cHptREVjSldJb3JmYVFyRjh2TGhVcjlnZFVlQ05DWkVjOE1UMEQ3N0FnL1MyNFJ6NWRnd2hLVWIvSW5OeVlTOUZkTytYS25Bc21jR2dOTmJHeGNQV3hZMkJyenQ4NlZ4aUxZM2tudz09 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * yHmPjmr
URLs

http://avaddongun7rngel.onion

http://avaddonbotrxmuyl.onion

Targets

    • Target

      RNSM00438.7z

    • Size

      66.5MB

    • MD5

      6aa1fd460f6a293bb4c678c6668023d1

    • SHA1

      adf38d81d249d6905dde3936972cd0b1b1ff6fab

    • SHA256

      ec32913ab37549bdee7e45ed16ab6c5ac2b52228298293fb47b86855a7a791a8

    • SHA512

      0c0c7ef472287121e65504ba4e0d91805106f8ad6555553e8742b13de854369ca61ec6aa664808266c13e0c0bcc4ae4bcfd23417cd1451447f762a58a618541d

    • SSDEEP

      1572864:S08JJ5gp1eUb7NeRCwxTUsv4DK3emG/i6Eza+9sFVB4+cXfy:S+jbsR1T+mOA6G19a

    • Avaddon

      Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.

    • Avaddon family

    • Avaddon payload

    • CrimsonRAT main payload

    • CrimsonRat

      Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    • Crimsonrat family

    • Crylock

      Ransomware family, which is a new variant of Cryakl ransomware.

    • Crylock family

    • Detect MafiaWare666 ransomware

    • Detects Echelon Stealer payload

    • Disables service(s)

    • Echelon

      Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

    • Echelon family

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

    • Gandcrab family

    • Lockbit

      Ransomware family with multiple variants released since late 2019.

    • Lockbit family

    • MafiaWare666 Ransomware

      MafiaWare666 is ransomware written in C# with multiple variants.

    • Mafiaware666 family

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Modiloader family

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • UAC bypass

    • Urelas

      Urelas is a trojan targeting card games.

    • Urelas family

    • VanillaRat

      VanillaRat is an advanced remote administration tool coded in C#.

    • Vanillarat family

    • Xmrig family

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • ModiLoader Second Stage

    • Modifies boot configuration data using bcdedit

    • Renames multiple (238) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Vanilla Rat payload

    • XMRig Miner payload

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Modifies file permissions

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Network Service Discovery

      Attempt to gather information on host's network.

    • Network Share Discovery

      Attempt to gather information on host network.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks