Overview

overview

10

Static

static

1

RNSM00430.7z

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RNSM00430.7z

  • Size

    25.3MB

  • Sample

    241026-pzzc2aslhv

  • MD5

    f64fdcf697c25f9db959e055e05a440b

  • SHA1

    afcee1ea932aafbf2dac520fcea835cc3548ee4b

  • SHA256

    4c659f57dcbdbcffb9c0d0d06b2d02a74ee2d306c52300a3892e4418c0d1c863

  • SHA512

    c1b3d40bd0255833ddded8ade13739cce94d69387b7c6949d65d489c2fd949848fe38f2992808d6fdd4eeb50a0a0a7ff825dfbc9dc287a4dfe3c2bfd6141a88e

  • SSDEEP

    786432:bLPIJ4PoBXVOi8Zh+OBOjX/GRBduIekAbl7jR:bLPIMoBlOFT+4Ojk/uIrAbv

Score
10/10
clopconticrimsonratfickerstealergandcrabjormungandmodiloaderbackdoordefense_evasiondiscoveryevasionexecutionimpactinfostealerpersistenceransomwarerattrojanupx

Malware Config

Extracted

Family

crimsonrat

C2

185.136.169.155

122.216.201.108

Extracted

Family

fickerstealer

C2

lukkeze.best:80

Extracted

Path

C:\ProgramData\readme.txt

Family

conti

Ransom Note
All of your files are currently encrypted by CONTI strain. As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value. To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.best YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. ---BEGIN ID--- SveULrMg1EtF3ckFRyPzvr0v78M7RL64mRMCe9qPWWCeJwYAuNWV8R6NGPs5PFBS ---END ID---
URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.best

Extracted

Path

C:\Users\ReadMe.hta

Ransom Note
<html><head><meta charset='UTF-8'><title>recovery tool</title><HTA:APPLICATION ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu="no"> <script language='JScript'>window.moveTo(50,50);window.resizeTo(screen.width-100,screen.height-100);</script><script>function countdown(dateEnd){var timer,days,hours,minutes,seconds;dateEnd=new Date(dateEnd);dateEnd=dateEnd.getTime();if(isNaN(dateEnd)){return;}timer=setInterval(calculate,1000);function calculate(){var dateStart=new Date();var dateStart=new Date(dateStart.getUTCFullYear(),dateStart.getUTCMonth(),dateStart.getUTCDate(),dateStart.getUTCHours(),dateStart.getUTCMinutes(),dateStart.getUTCSeconds());var timeRemaining=parseInt((dateEnd-dateStart.getTime())/1000);if(timeRemaining>=0){days=parseInt(timeRemaining/86400);timeRemaining=(timeRemaining%86400);hours=parseInt(timeRemaining/3600);timeRemaining=(timeRemaining%3600);minutes=parseInt(timeRemaining/60);timeRemaining=(timeRemaining%60);seconds=parseInt(timeRemaining);document.getElementById("days").innerHTML=parseInt(days,10);document.getElementById("hours").innerHTML=("0" + hours).slice(-2);document.getElementById("minutes").innerHTML=("0"+minutes).slice(-2);document.getElementById("seconds").innerHTML=("0"+seconds).slice(-2);}else{return;}}function display(days,hours,minutes,seconds){}}countdown('10/31/2024');</script><script language="VBScript">Sub RunUTOX( ) set sh = CreateObject("Wscript.shell") sh.Run "%windir%\utox.exe",1 End Sub</script> <style type='text/css'>body {font:15px Tahoma;margin:10px;line-height:25px;background:#000000;color:#FFF} .bold {font-weight:bold;} .mark {color:#ffd731;padding:2px 5px;} img {display:block;margin:auto;} .header {text-align:center;font-size:30px;line-height:50px;font-weight:bold;margin-bottom:20px;} .info {background:#000000;border-left:10px solid #000000;} .alert {background:#FF0000;border-left:10px solid #FF0000;} .private {border:1px dashed #000;background:#FFFFEF;} .note {height:auto;padding-bottom:1px;margin:15px 0;} .note .title {font-weight:bold;text-indent:10px;height:30px;line-height:30px;padding-top:10px;} .note .mark {background:#A2A2B5;} .note ul {margin-top:0;} .note pre {margin-left:15px;line-height:13px;font-size:13px;}.countdown{width:100%;float:left;margin:20px auto}.timer{font:72px Courier;color:#fff;text-align:center}</style></head><body><img src='data:image/jpeg;base64,/9j/4AAQSkZJRgABAQEASABIAAD/4QBmRXhpZgAATU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAAZKGAAIAAAAxAAAALAAAAABQcm9jZXNzZWQgQnkgZUJheSB3aXRoIEltYWdlTWFnaWNrLCB6MS4xLjAuIHx8QjIAAP/bAEMAAgEBAgEBAgICAgICAgIDBQMDAwMDBgQEAwUHBgcHBwYHBwgJCwkICAoIBwcKDQoKCwwMDAwHCQ4PDQwOCwwMDP/bAEMBAgICAwMDBgMDBgwIBwgMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDP/AABEIAFAATAMBIgACEQEDEQH/xAAfAAABBQEBAQEBAQAAAAAAAAAAAQIDBAUGBwgJCgv/xAC1EAACAQMDAgQDBQUEBAAAAX0BAgMABBEFEiExQQYTUWEHInEUMoGRoQgjQrHBFVLR8CQzYnKCCQoWFxgZGiUmJygpKjQ1Njc4OTpDREVGR0hJSlNUVVZXWFlaY2RlZmdoaWpzdHV2d3h5eoOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4eLj5OXm5+jp6vHy8/T19vf4+fr/xAAfAQADAQEBAQEBAQEBAAAAAAAAAQIDBAUGBwgJCgv/xAC1EQACAQIEBAMEBwUEBAABAncAAQIDEQQFITEGEkFRB2FxEyIygQgUQpGhscEJIzNS8BVictEKFiQ04SXxFxgZGiYnKCkqNTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqCg4SFhoeIiYqSk5SVlpeYmZqio6Slpqeoqaqys7S1tre4ubrCw8TFxsfIycrS09TV1tfY2dri4+Tl5ufo6ery8/T19vf4+fr/2gAMAwEAAhEDEQA/AP5/6KK9Q/ZS/ZO8Tfta/EIaRodtdRaZYmOTV9VSyluodKhYkBikYLPI2GCRjBYqxJVFd0mUlFc0thxi27I850XRbzxHq1tp+n2l1f315IsNvbW0TSzTuxwqoiglmJ4AAya+tPgT/wAEa/iJ8SJdOuvFuq6H4D0jUrtLa3eSUapeXivI0IlhS3JgCeeoj3T3EAZm+UuRiv1F/Zc/4J3fD3/gnRZeF9S8XeBbSb+1pbi50q80nVI9V8aXUuVe1nW4VYIrazmMU3lzoULLFbjyEkkuGfo9X/a81bR/ButaTpOoQ+F/Dup373si6MyQa2yu6yRxf2mRHI8qOgMbYRplJTy0dCp+dxWdSb5cOvn/AF+R6tHL42vUPnL4a/8ABtB4Fn8P/Ztc1L48a5r9vZy38507w3/ZEc0SSon7qGe3mGf3qDBnJbYzAAHavnX7RX/Bvr4V06xt2+HXizxxpcdvf32nalq3jbSZbfS7ee1MaLHvW1if9/JIwRgrDEDY371x9g/EGfxrJY+DPGereKPEXiDxJ4g1LUvDel3lh471OLVIvJg+1zRx7l8iJJvs6lkgnCl4Y/8AWkDbzPhX9pLWP+Fda3pOn+LdTj0HVjNcanpo199esrlppPMklvzciWLEjHLQoC8xZgcbufLhj8Wnz89/np+R2fVaLWyPya/aL/4Jd/Fb9mzULuPVrHSNQtbUSObiy1KH/Vqdqko7K4d23IseDI0iMgUtgH591XSrrQtUubG+trizvbOVoLi3njMcsEikqyOpwVYEEEHkEV/Q9YfHzQfjN8RdLt/HVtd+DbGKO4gN34N0+KwMt7JKqpcajp+9rS6iVBcJNGsa8XLRv9pAlEPy5+25/wAE3/BPxQ+Hmn+ONdg/4RVtQs7+9tfFGlWK21p4qFnbtFLcYYyFZy1sbh7a8khl3OIN0bmW4b1sLnnvcldfM462Xpq9M/Hyiu4/aI/Z28VfsufFK+8I+MNOksdSsyWik2OsN9EHZBNEXVWKFkdSGVXR0eN1SRHReHr6CMlJc0djypRadmXvDXh288X+I9P0nT4lm1DVLmO0to2kWMSSyMEQFmIVcsQMsQB1JAr9wP8Agnl+zBZ/sHfAXQde8TeDNP8AH2j6k+paZbRXd3HJZazrd1FZma4+ySyAXekww28cJ3RRu9yyLjyn+0L+Yv8AwTK+E+peL/ixrniqztNekj8F6YzR3GmIjGG7u2+zRKw3iYkxPcugtklmLxLtik5Wv1j/AGotQ8Oa78UtQ0nwdq+p33gHSlu4dGTVb6Sayt7OBI11BrWKfcILZ7gLHJBGmR5qo0M0Ii2eFnGInzKjDbdnqZfRVvaMlu7TQNU8JNqWtfEjwbZw3+mSXa2uoT3d5ueadY47eaV0kUWpQF5AFdYreFFaGaPy44s/xr4p0nwD4d8cal4M+LVhrWvLoupwaK+lJeQakUgVJZr4hi3kxb12xvLJJK7F5AyGSQScHbeINdstD8W2um+JtV8EeINY0ryrXWLW4uFn065e7tpsedbmSVS8cLxl0Z1mMgKvK28J5n+0f4Z+LPwZ0vwnqHjT4rfEzxfaeMEvprCPV9c1Pa0cMVm7SmK4ncPFNDqEDLvVSyu4ZAOviU8PeSV7eXfqehUrcquexaP8UfE3iP8AZoXxe2peNodY1TwhCup+JLG9uIZr94PEIQxS3KFSZPLj2ncx3R4U8cVbN5qfiL4KfDzxnJrjeJ9Z1Kzj09rG1jm1LWbKe2h8lb6aRt7tJII/LjkDB43bc394eafstfsZ3X7VXgePW9D1m302aR1W/gaW20+CyaTULixiy002WZmgaRjDCxVM5BO0Nxfxm+CN58FNRX+0YY761uJBE91dWKwTDE9xCJ4mVn+0WkklrcolzEwLPA6yRxboDPtGjHmcE9U72M/aNx5mj17wRrVjc69p0zR6fNZx3MG+P7U8Ns8KuVKrKoLoqBXBJUuEViuXW4jb1i71TSPAnxx1TwtraeLpPhsNXkkl0TSPETSyoWj22uo2k9s4SW7hAElvMuTII2WRQ6xrN8+/s6avrnxI+KOk+G5pNQ1y/W+sX+3oYZL2a0eeKJmJmZVmubdjA0RZvMmRREd7w2fl+rfGnU7PxN8ZfFWtadNodzpWqarczfa9NszZ6feK7GT7SIpFIVZUUzSEoyCS2uAd48u3bKWHvOxrGStoeH/ta/sGS/tMeD9V03zNS8Pt4Y02PXvAtq9tDZW2q2+plhY3T+ZdLbBL1bW2gZ1aSWJI4JJ7hxbTI35J1++k3iiHxj8BdY8Ual4ij1jQ/hNfRaLqmiT6Xl5NE1OaNb1A86+fLdQyJcfuXZl+z6tJG8qreSs34+/8FE7Bbv8Aag1bxPbWN1Z6b47hj1+2lu9U/tG61GRi0F5dzyl2bzpb6C8dwQg3sxSNIjGo9vJ68rulLZfh5fO9/vPNzCirKovmfY3/AAbpfC/xxe/FOx8TeCNS8Lrd/wDCTLFJpOs6xf2NrqhtLKW4RZlt4JVKAykq/LI/YEoH+jrnXDrWtf2jfXf2q91i7it76aBCsn9oozSi7QKMq8oucSBT84RAdwxXyr/wQZ8XeCT4pt/D+vjxH4Za88TLBrnjDRrq6sbrTdNu7N4IoI7q3VjDuuEJLSbQPk2nJbH0/wCJvEC61oxn8K3K3usM8Wr2MVjvto7+9vGUQW1s26NoXWCDzC6shg3RMxjwM8GYKX1uWnRdP1/Q6cNJexjYoat4b13xpqEHh3QLfOtanNc2OyGNHlM5nRPMso2R9zTR+aJYNjxMXjzG0ZleHj/2+bTxNo/wE+HOmeK9D0/w/rvhPWdT0WSzg0+a1ZYJtK0GS3klWUeY0ri1lJkZndwqhmbBx0n7J/xLt/EP7R3w3bT/ABAsNreavBthfQ7dVuICg2tFG9uzMkiyxlVEaiMSxbbe2XZCut/wVosLuPQda86LVPI0nxH4UFs17pgsBKLvRtdSXZbfZbUR/NYR5YW6hztIZ8ZGNOo44mFKS8/xsVUi3SlM8u/Zg+PXgX4Y/B6GDX9R1q38cWFzex6M3/CMnWdKe3uLiOVzcIxEc2AjbUbhWO7Dg4C/Gj483XxYt0sYDcSaaotIbi5vLSGyxHamVobW0s4mMGnWoluJpmggwHkkQscRKKq/sD6d4L17wvptr4uuvC+g2V54o1u0m1y78K2WuXUfl6RpUtjaRmaNplV52nI8pgqmSQtjcDX1N4/+DH7Od5ZahoMGseI9c8YXt5a6dodhZ+CTomoPLPeWsKyRzmBXceXdwssLf6PI7Lu3gkJeIqUqeIas/uYUY1J0lseV/sP+J9H8DfHTwa2jatpMMtzrVveeIbzUr6bSp9C0uzSeUCJlZGuI5Z2gmmktpHKC2iVo4497y63jrxPb32ua5Dp8sM732s6lawtazOyssGoSfZJjIGWdVCiWKAF4nIF1IHR4t6fJ/i3X9U+Gl3qV5pWpW8Op+E5J72yv7Fy8CXVqX2TQtkkxM0YYBiQ6MA24E5/QD9nPQ/h78LP2jda0fXdC1PTX8P8AiHVbGCTW7e01XSrSFZZo3t7aAwvNFFB5cMSyTbyXgIfzIrYLBliLU/3t7/8AD/8ABNaEXO0UtTD+BHwR0r4leL7Lw9qum6xLY3ytJKJfClrcI8sY3J/pLXMMMWMDAR0T5SERchB3Hw//AOCXH7Pv7S0esah8QvhW3iLUvDuq3GhWNzZ395o8SWkRDhPLguoxI3myzM0rbyzOwV3jWM133xx8dW63/gHxF4H0u1XxFYtqdtf3egR2di8Ucn2JYjhY0iuEdhdFW2ggFz+73Fa5Lwl/wUG+An7J39paT8dvGTeE/F/iG+fXba31PStS1a5urORVhEzNZ20kUQM8Fwoi3ZURg4AYVxQq1qr5qF7vte/4HVUjCEf3iXz2/E/D7/gnJ8bta+Fnx4h0fRrmOC88YPbWWnNc6nNZWdrqsdzHNYXLhAyOyyqYR5yNEFupPM/dl8/rF+07rur+ML/S/i1daHpmgaL8Slu7+0s7fUJPIsELIt9aTSTx25gkEkSS3HmBWULG0rwxBwfwj03U7jRtRt7yzuJrS8tJFmgnhcxyQupBV1YcqwIBBHIIr9WP2Af2xPDv7QPw18XN460rxJs0nQZLk3+nXrXEfh3V02yT36WMKokcOoMfMuCVkKtal0CpbuH+qzLD6qtFeT72/qx4GEraezb9D0S98L2mofDI6hZR2p8XJ4ms4dPuBO+la1GscUihQCsZmhzKIpoV8qSxcxKot3uXLeL/ALXP7VXhweCPFnwl0/7brPiDwr46nXUPHuoanHDe+LP7Mm1G1sy1snywxItzOIlRgFWXGCeR75430PxH+zJ4T1TwH4q07xh4T8Q6fq9l4gsbdLq0+w2jxxbTIHyEjmjV8i4guDDIFVSI1RnOT8LPjaukfEfTL7xdcaPd+FEvZp9eF54ajvZY7dY2Vokjg+yXMbpMUUrITM0kgQqrK6p5MZKMnUavbVf1b8Dvs5R5b2ufM/7L/wC1zYfs+eGNa0i58I2fimHXJ3u7adrpLWTSJmtzbm4ty9vOv2hFEbpLj5XRSVcAg+heAv2mPEnxRsf7G8EeFfEFxeTRtbyyW8cuta5PFIW3Rr9kt4Y4w/zKZIYI5mUFTIVAA9p+Bvhnxl+zn+2V8ffE0nhrxp4U0GbXdG1Sz1W00+50uxlY+I7GdoYLgpHC6iO4mJiVsFEbjCHEX7Nnwo8bfATSv2k/C+qeGdb0XRPE3jTSbDTLfVdKktbXXbFW8QpJLaCcKksa5siJIw6qZos4WUBlialOSlK3SL37pflcvCwqJqCflt/XY89+C3wWHhfx/p974tj0WH+w5U1GXw9NIl1M/luGjGpRQufstrvCq9tIyXMw3QpEu/zB7l47k8bweC9S8YaJ4d1zWdUa9ih1G+PlTzWVzdOzQrKg2ma7nfcziKNgZ3Lv5SGP7V3Ph680eK/kvpvAnw3svtF9Dqf2bTtNOn6farGhWGNUSRVWMEyMXZt7bCjOQkhPX2sPhLWdG0228Uaj4f8AAmi6ek83mx2IW41m5mlIEYjndUnuNxdUhJUIokHlpGjpXhVsfzytJHtQy+pCN47/AInneufC+0074M6ZYTf2x/wse9kttSvPE2q3cyaPo+k+XdK94qzMbea2mlimjKpExeO3E22P7O8kf4x/t+fF3TfjJ+1N4kv9B1LW9S8MacyaZo51O4SZ4YIlAcR+XJJEI3nM8o8ptjecXAUuRX6Jf8Ffv+CgHiH4ZWdzYXN14Zb4i+JoxB5OnefGfD1osBijuLGVSGjUSmfY++OVykRKmPzI5PyHr6rIMO+T28uux89nFZc3sU7tbhXS/CP4q6p8FvH1j4i0j7LJc2bESW91H5ttexNw8MyZG6N1yCAQR1UqwDDmqK+haTVmeKm07o/WD9gj9v8A8MftK+MNP8H+LvDviDxwtxoyaFpGl3euiPXvDEdqzSRPpt0kSQymVpQ8im3CxLBK4EMcRF16V4V/Z4svHmmfDz/hCfHHg/xZ4v8AGUNvCugadeLpGpWk62rSOsBml/eW6bXj+0RPOsS7FQbnZj+Kteij9qzx1P8ADnT/AAffawuqeF9MkEsGn3ltFIoZRKELSbRK23zW2guQMIBwigeRXyu8uai+Xy6f16W9T0KeO0/eK/mftv8As7/C34qfs5/FqOSP4QeMPGniTwdsllsYrZls9OW4UtGrSrG8lwsipN/y1yCoyeNpk8D/AAH8Ta34P8K69a+G7nS/Dusw6dpelXmoxxW1rBA0KLbnI2xS20giBJYjLbQrDKqfza+Fv/BXvTfh0qyD4c+IrW8lltbm7bQPiFfaLDdSxCTflI4mPlsZNqxszCKOONFOFJat43/4K+Le+B7PRfD/AMN1WC2t4rHyfFXiW48QWsdukVxGwiUJBLHJIJoy7GVlP2WHaikMT49bJsTOd7L10/K7PWoZpRp7P8/8j9bI/DvhvwprOraJrFxrfjDVJo7aLST4Uv0isJJ7rzI97anMnkqYpIlG+PecBGfLRKW+P/22f+Cytj4E8KWlhNfab4z+JNro7WFro+m6Z9j8L+DZGaJJoWgMzOLlXicSAtJv8qNSVT735ufEb9ur4rfE/wAIQ+HdQ8Zapa+Hbe0/s9NL04iyt2tf3mIJfKCtOg82Qfv2kJ3tkkkk+SKCxwOSeAB3rowvDcIvmru/kgxXEU5K1JWfd9PRGr438c6x8SvFV5rniDU77WNY1BxJc3l3MZZpiAFGWPOAoCgdAAAMAAVlUrKUYqwKspwQe1JX06SSsj5pybd2f//Z'><div class='header'><div>YOUR FILES ARE ENCRYPTED</div></div><div class='bold'>Your PC security is at risk</span></div><div class='bold'>All your files were encrypted and important data was copied to our storage</span></div><div class='bold'>If you do not need your files, then the private key will be deleted within 5 days</span></div><div class='bold'>If you want to restore files and return important data,<input type="button" value="start UTOX" onclick="vbscript:RunUTOX ( )"/> application, contact the operator and enter YOUR ID </span><font color=Lime> MUYKSRQK7</font></div><div class='bold'>ID of your personal operator </span><font color=Blue> 204E91D375BADE81DC528EFCC105A5D046DB92FCC4B75F08E151053DCD8D5025DA55D689165D</font></div></div><div class='bold'>If the Operator did not respond within 24 hours or encountered any problem then send an email to our support </span><font color=Blue>[email protected]</font></div><div class='bold'>In the header of the letter, indicate your ID and attach 2-3 infected files for the decryption tool</span></div><div class='bold'>Files should not have important information and should not exceed the size of more than 5 MB</span></div><div class='bold'>As our guarantees, we will return your files restored</span></div><div class='note alert'><div class='title'>Attention!</div><ul><li>Do not rename encrypted files.</li><li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li><li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</div></li><div class='countdown'><p class='timer'><span id='days'></span>:<span id='hours'></span>:<span id='minutes'></span>:<span id='seconds'></span></p></div></ul></div></body></html>
Emails

color=Blue>[email protected]</font></div><div

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-3227495264-2217614367-4027411560-1000\Readme.README

Ransom Note
Hi Company, Every byte on any types of your devices was encrypted. Don't try to use backups because it were encrypted too. To get all your data back contact us: [email protected] [email protected] -------------- FAQ: 1. Q: How can I make sure you don't fooling me? A: You can send us 2 files(max 2mb). 2. Q: What to do to get all data back? A: Don't restart the computer, don't move files and write us. 3. Q: What to tell my boss? A: Protect Your System Amigo.

Extracted

Path

C:\Users\How To Restore Your Files.txt

Ransom Note
############## [ babuk ransomware greetings you ] ############## Introduction ---------------------------------------------- Congratulations! If you see this note, your company've been randomly chosen for security audit and your company haven't passed it. Unfortunately your servers are encrypted, backups are encrtypted too or deleted. Our enctyption algorythms are strong and it's impossible to decrypt your stuff without our help. Only one method to restore all your network and systems is - to buy our universal decryption software. Follow simple steps that discribed down below and your data will be saved. In case you ignore this situation, the consequences could me much serious, than you can imagine. Guarantees ---------------------------------------------- The hack and system encryption wasn't compromised by your competitors or any other 3rd party, this is just and only our initiative and only thing we interested is profit. Accurding the previous sentence We are very much value of our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We guarantee full support and help through the all decryption process. As the proof of our abilities and honesty, we can decrypt few small files for free, check the link provided and ask any questions. Data leakage ---------------------------------------------- We have copied some quantity of data from your servers. Check those proofs and estimate the seriousness of consequences which can occur in case you ignore us: http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/blog/85a561daffd57e8d98486ad0647dcbb578c2a6d0f0269a4c4f9acce1798ade42/ This link is private and only you can see it. Use tor browser to open link. Ignoring the interaction with us brings you the publishing your data in our public blog http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/ Contact ---------------------------------------------- 1) Download tor browser: https://www.torproject.org/download/ 2) Open it 3) Follow this link in tor browser: http://tsu2dpiiv4zjzfyq73eibemit2qyrimbbb6lhpm6n5ihgallom5lhdyd.onion/546838a4129734c99d8356153e220af78e7863cf49ac908304b07cd97192508f * 6 simple steps do minimize harm from ransomware. ----------------------------------------------------------------------------------------------------------------- Thousands of companies around the world are struggling on ransomware these days, and the most of companies are making the same mistakes again and again. Let’s figure out how to minimize harm and do not be a dumb and pathetic donkey which will make fun for journalists and so on.. 1. If you see small fella malicious .exe file never load it to virustotal.com or any other virus researching website. Otherwise the info about the hack is not a secret anymore. The fact that your company is under ransomware attack is already known by filthy predators data security agents who will post in their pity twitters the fresh known news “OMG ANOTHER RANSOMWARE NOW IT’S “Your company name LLC!!!!! We are all gonna die aaaaaa halp” 2. No any public announcements about the hack or data leakage. And do not applicate to law enforcement. If you commit this actions, more serious consequences can occur and you pay much more than a ransom amount. Law structures like GDPR in this case can oblige you to pay huge fine. 3. As soon as you see your network compromised, follow the link inside any note and follow instructions. 4. Calm your employees. Explain them that this is a drill. And you test your network security systems. 5. If you decide to hire the data recovery company, obligate them to do not inform anyone and any third party about details of the attack. We strongly do not recommend to cooperate with data recovery company, because they do absolutely nothing that you can do by yourself and take money for it. all communications with hackers could be conducted by your it department indipendently without any extra payments. 6. Do not try to decrypt your data via 3rd party software. Most of ransomware use strong encryption algorthm and you can harm your files by using 3rd party decryption software.
URLs

http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/blog/85a561daffd57e8d98486ad0647dcbb578c2a6d0f0269a4c4f9acce1798ade42/

http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/

http://tsu2dpiiv4zjzfyq73eibemit2qyrimbbb6lhpm6n5ihgallom5lhdyd.onion/546838a4129734c99d8356153e220af78e7863cf49ac908304b07cd97192508f

Extracted

Path

C:\Program Files\READ-ME-NOW.txt

Family

jormungand

Ransom Note
Attention! infortrend!!!!!!! --------------------------------- What happened? We are Jormungand ransomware Your project source code and customer information. Important information has been downloaded. If you do not redeem it as soon as possible, it will be exposed and you will be responsible for the consequences. --------------------------------- How to get my files back? --------------------------------- The only way to recover the file is to contact us to buy the private key. Please contact us with your Unique Identifiler Key --------------------------------- What about guarantees? --------------------------------- We understand your stress and worry. So you have a FREE opportunity to test a service by instantly decrypting for free three files on your computer ! --------------------------------- Our email address: [email protected] ----------------- Your Unique Identifiler Key: XE/lY3wguit770mqqppKldgd3myB5kod75sPptGcJhn5FHPqm2+emgolFv5m4Kq7iS1X0nm8jBZVdDHcCPf0HZVQkHrT32xfslh68ISa2/VDXtl+u0Qsi+RGe0CCJIVHIeDuColSjUMG9f8oEGBAkvz/saN4rJZgxYIUo7oh+/g=

Targets

    • Target

      RNSM00430.7z

    • Size

      25.3MB

    • MD5

      f64fdcf697c25f9db959e055e05a440b

    • SHA1

      afcee1ea932aafbf2dac520fcea835cc3548ee4b

    • SHA256

      4c659f57dcbdbcffb9c0d0d06b2d02a74ee2d306c52300a3892e4418c0d1c863

    • SHA512

      c1b3d40bd0255833ddded8ade13739cce94d69387b7c6949d65d489c2fd949848fe38f2992808d6fdd4eeb50a0a0a7ff825dfbc9dc287a4dfe3c2bfd6141a88e

    • SSDEEP

      786432:bLPIJ4PoBXVOi8Zh+OBOjX/GRBduIekAbl7jR:bLPIMoBlOFT+4Ojk/uIrAbv

    Score
    10/10
    clopconticrimsonratfickerstealergandcrabjormungandmodiloaderbackdoordefense_evasiondiscoveryevasionexecutionimpactinfostealerpersistenceransomwarerattrojanupx

    • Clop family

      clop

    • Conti Ransomware

      Ransomware generally thought to be a successor to Ryuk.

      ransomwareconti

    • Conti family

      conti

    • CrimsonRAT main payload

    • CrimsonRat

      Crimson RAT is a malware linked to a Pakistani-linked threat actor.

      ratcrimsonrat

    • Crimsonrat family

      crimsonrat

    • Fickerstealer

      Ficker is an infostealer written in Rust and ASM.

      infostealerfickerstealer

    • Fickerstealer family

      fickerstealer

    • GandCrab payload

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

      ransomwarebackdoorgandcrab

    • Gandcrab family

      gandcrab

    • Jormungand Ransomware

      Ransomware family first observed in March 2021.

      ransomwarejormungand

    • Jormungand family

      jormungand

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Modifies WinLogon for persistence

      persistence

    • Modiloader family

      modiloader

    • clop

      Ransomware discovered in early 2019 which has been actively developed since release.

      ransomwareclop

    • Clears Windows event logs

      evasionransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • ModiLoader Second Stage

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Disables Task Manager via registry modification

      evasion

    • Modifies Windows Firewall

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Direct Volume Access

1
T1006

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Indicator Removal

4
T1070

Clear Windows Event Logs

1
T1070.001

File Deletion

3
T1070.004

Modify Registry

3
T1112

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

5
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Virtualization/Sandbox Evasion

2
T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

4
T1490

Tasks