hades | 7d3f9f20a5bcdb6e2e9d53685af5b7f46d3604d5d9a9539cf8b35c8c41addd45

General

Target
RNSM00414.7z
Size 6.8MB
Sample241028-vbftnstgql
SHA256 7d3f9f20a5bcdb6e2e9d53685af5b7f46d3604d5d9a9539cf8b35c8c41addd45
MD5 4ba05bc378b38b52acaadfe09cf3122e
SHA1 3693e47da4d01d389ea59bb4451494710fa5b17b
SHA512 bef4cec704fe2a89be5594083902549e9fbf6a6d2123f26f19a4a9cb41ababea6adeb13e3c157710dbbe7d4dee1fac27b94fcfeb3e5e488af3cf62a9f4a87f03
SSDEEP 98304:sGntqpfpepXXmmNMQPHZk9FnTW+1O1kOeJEP41yCtaJkLBjhnEvh7k9h5KDZXXiS:sCtSepnZBk9FTW+Up4ttHKWK0KqC5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

warzonerat

C2

194.68.59.48:2318

Extracted

Path

C:\Users\Admin\Desktop\HOW-TO-DECRYPT-gn9cj.txt

Ransom Note

[+] What happened? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has extension *.gn9cj By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant get back your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] Using a TOR browser! - Download and install TOR browser from this site: hxxps://torproject.org/ - Open our website: hxxp://khfsk3ffg3av3rha.onion - Follow the on-screen instructions Extension name: *.gn9cj ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) will make everything possible for restoring, but please do not interfere. !!! !!! !!! ��

Targets

- Target
  RNSM00414.7z
- Size 6.8MB
- SHA256 7d3f9f20a5bcdb6e2e9d53685af5b7f46d3604d5d9a9539cf8b35c8c41addd45
- MD5 4ba05bc378b38b52acaadfe09cf3122e
- SHA1 3693e47da4d01d389ea59bb4451494710fa5b17b
- SHA512 bef4cec704fe2a89be5594083902549e9fbf6a6d2123f26f19a4a9cb41ababea6adeb13e3c157710dbbe7d4dee1fac27b94fcfeb3e5e488af3cf62a9f4a87f03
- SSDEEP 98304:sGntqpfpepXXmmNMQPHZk9FnTW+1O1kOeJEP41yCtaJkLBjhnEvh7k9h5KDZXXiS:sCtSepnZBk9FTW+Up4ttHKWK0KqC5
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

hades warzonerat cryptone discovery evasion execution infostealer packer persistence privilege_escalation ransomware rat trojan
- Disables service(s)
  evasion execution
- Hades Ransomware
  Ransomware family attributed to Evil Corp APT first seen in late 2020.
  ransomware hades
- Hades family
  hades
- Hades payload
- UAC bypass
  evasion trojan
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Warzonerat family
  warzonerat
- CryptOne packer
  Detects CryptOne packer defined in NCC blogpost.
  cryptone packer
- Renames multiple (171) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Warzone RAT payload
  rat
- Stops running service(s)
  evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
behavioral1