agenttesla | c21aa3d27a5957e5c39e4c0630d1c0e6a9083a670e0f1c81a1fba9fa1115442c

Sharing

Copy URL

Twitter E-mail

General

Target

RNSM00379.7z
Size

27.9MB
Sample

241104-wjg75stmds
MD5

59e53cc4c3a9cb4d0b965ec637bcf169
SHA1

cd9d547d737e2ca22d32722c23c1552e5e104b01
SHA256

c21aa3d27a5957e5c39e4c0630d1c0e6a9083a670e0f1c81a1fba9fa1115442c
SHA512

7c97a623dee692afe2d6380901ea6b5afad44ac9ae092ffc6114c26035faa77e5d3da81698ec3b6ae61ef64ff989741cc23f5dcf05cda7b194a758ec18ad06f4
SSDEEP

786432:Y1c0lgTFvGoWFeKnWdNp/A/hcZD3pMawtwvLytbPM19:Y15lOFgFeKnqIhUDZGwDytbA

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

187.162.62.135:80

181.231.72.200:80

45.55.83.204:8080

104.236.217.164:8080

128.199.78.227:8080

46.101.123.139:8080

185.94.252.27:443

181.171.118.19:80

46.21.105.59:8080

105.224.171.102:80

86.6.188.121:80

190.246.146.101:80

200.80.198.34:80

200.58.171.51:80

109.104.79.48:8080

89.134.144.41:8080

159.65.241.220:8080

186.23.146.42:80

203.25.159.3:8080

190.1.37.125:443

rsa_pubkey.plain

Extracted

Path

C:\$Recycle.Bin\YEYFQM-MANUAL.txt

Family

gandcrab

Ransom Note

---= GANDCRAB V5.2 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .YEYFQM The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/5ef1df3d38d4324c | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAHDlol+ijchnq1YSzUPMFe0FT+qYf2xKtA28Y3LrLIQQNqRLBRtEPLBowukVlfwumGH0IleCEfPKG+76we5+2/yyaQEY5wwWVQ8Rj6pUCvBECVr755Xl8qREENmAONBij6nXQx9lTfCcDoW+M4VI25Am3ww3CuuFO6otSvYKIaXLdRo/7jPayJuczyIRcY8FvxRs3oQGadh6u9cea+IuHNrM33gCLCEcSbhjWgCiQHDsp6CswMoZU00+KMDSQtfpnl01r/SMrTZlpCpxvZvA87298ByLJnPvTBYZiZ6At7X3H8/3olDGR+0m/WCs4F+fcqGrpc/U8i2MPWBHpQQ2MjINO4my7VF8qwNuSfquliiEqzOhocrQqQwVcR05G8k5Z9+csJNqYZrplYiyVIIkD8vAASi2ym5POI2OoBgRaXCCcn0AvkRswi9LXz1OhUQiNL+aHHyouYEKPik6iRTDEaXMLpoXcNipW1SQUxXnwWcPzd3q5UdrD0cE027hUn9kxttXEgWQSbrjXXP2gvN2n/Hb0Flon/lTqhHCLGw4uobZRiZMzxES15avNHxWmHKlhhe2iScHeHK5lKmunTIqLwOf9J5HI6P/bgOMTLPk4PPPJJKiKiH8rWYBJKtgV+6is6Ew/XMh9IgvBEabVU8Ojrp3IFamQcBpdymHAi8Txnqr4WoYhWF0KfknEow2lKWaRFzFt7l7g2vK3nD/Y4WC7DEVukRnXYMmHS+XPomyWVrVDjTou0lhBw2++bwwx1pfoSMdKc5+bHUeuGEM9pQnMxpFUfOvH0XT+EhkEo3rNyX27G2lO+Vm/Fb707f7UdOBOJqlcyN7IrhW7vDJM1CQ0Df0YwYiRImP/DfzkIKVgBC9I2Z599jwiJ8w8ZvQv+QCUEfnQq3KSc1UNbHdsjuffGIdVMGBxQVg8SBskXLd49hxfZbq5m9B/0TQ2dT6RXhuHccQon4sICvsFWMMuChCMhEgk91beNAh/Wv1flaysKe3Bz7DBmYn3nIvMgZER/briE02+V4X5+G68Q+oBYGFAJvMKvko8QWvR3XQqeckCI9uneSRbkLo4XCzPD1Wsc8Ls4zxdbT0pBmMGklhyR4ruUJSAI3mRfpVebpM35eWgw0DCafXpyQx4/HbIlDPY2G7SIPcrq6uzc+OKgUCVS+C7UwDmyZYpipZ41TinEm77M16ARRTl4bkI8AFCiXrtnzV9CGsNI0qR9qZz+sY/DpYuyd9EgYMbXOnRh9Zw+840T1JK6UYamC2hJsYTjPwy3EYZXZirBqN4xS0whHxSpOQpviczLGOZGi4daUWcyWnoTn055lsVmQwoVcm5pJCu0omEEOEO56PNyFbmeqiurbmOJ166vCVWhmuwEmPof1Udp/NBSeYIMbj5R3dgPuBIXU7UTgaWoXiy41X3Ayzxzg9frRIk9lc1nZia6z7ZLbrSmImVcQmKGHaycNGJ6PbqYpIg9UfAjeBw0tWPDCiIWruUHrFmBrSib5XnvGwjixQMoouBOvnqZ7gk0hOOQtwLTYhubkAJrAuLFYBv7YwCgUWWmkZ+P7d6PBBYJT8LnkCc5eCd/w+W+kYyYrwVupL2gu1txRlCPK/B/SxzeHm8xf5zABnSGIejAdW2gwGbRlektYv3WKKcnv7nHixlMFpL9SjRqUEg11pCo+i1hXsVKZe2vMWHGL7eC76nFWALsndG7r2L1KooiVbQdOErNqBFzCsucutvRHf6Y+5G5SAxL2lDaZ3GNbSd4Lg6LBmDct1CP3nHclNG8oAFIZ2pWvRqmPkf1po5Q/seiW/UnUgQmkapEbpl+ds9Hs2ci2XyDqPaiWWdqahnyvR6esxU/MZ+Q9AmpsnMJfLidbL9D/jB9qxvUXDTnb6Fe1dhhauAn38UQkkqjLSLfsEzXwhjBaSOt58wNt/H7PitPFe8yO4VudqutI/gR4L2T0A8z0xtp3SDsMy23pxTxJGzaPPza8T9GMsdekU83TLjFN/0uDoRR/4EkD4Z8FkDTQDOhdjzN4YZ1MbGtbVUhWik9oRSwZwz8WQ8mumNNKy38GL54Lmc3YAiAmawYPRjhZR03XAgfb9Sz0lP4+uRDyjMaPw3SUvbJMFhNaFC4afO1HonnMyvZLsC6cUPMWRmSBzG+R4299HTPHCG2l2saBSRvmxNKD9SI/4kEcW0iIvMTJ8glDMO7NMYPFWqiiNpiztwNi6iLeuRG6k0Pndx37sBQbCqVJBRAxWG2DLKgQ= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmDn9M3JLpDWAu+VvODPRWXIKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2gU1R7jNx2WKAyu4W+5zlHFnKwMISBi1CwemOo6FrxnP+Z5F9bSR7OvDBsmLj7oYD6GBgpBqj3RSAVfvfE0yZSXyCRtLeJeNBYBnJqr8ZqR7a3MrGYmdeRhEfUP93y//NnLLDjCqP0r1BW4eYoT03JrPa/L0B0wffnS0ez96BFoTHFq52HPDCx6yhEudvoPVoM6iaVy+mvqAdvYbwBrtoypS8D1fKlXTmS7q54Auw6gT2wK0yub5gfz9wpLQCj3bimwDPi8jPeKPiggI2bWKz+7QkWvC2ihYFfEuZEsyM4ANvhxNQXIE31UkGbyf6MN51c1gY/+uQbe2gEznTbCqfrOdcnPBOVfcolLq8b9QmbcC2V7bCGEZisVbSQnNiaPkJ9b5I041HXc2vSx6IODB3F1IH8qANwhkbcxMPGvnUSm+rK ---END PC DATA---

URLs

http://gandcrabmfe6mnef.onion/5ef1df3d38d4324c

Extracted

Family

gandcrab

http://gdcbghvjyqy7jclk.onion.top/

Extracted

Family

sodinokibi

Botnet

Campaign

2932

Decoy

premier-iowa.com

turing.academy

physio-lang.de

rarefoods.ro

palmecophilippines.com

ddmgen.com

omnicademy.com

baita.ac

cmascd.com

nationnewsroom.com

belofloripa.be

babysitting-hk.helpergo.co

tages-geldvergleich.de

iactechnologies.net

line-x.co.uk

richardiv.com

goeppinger-teppichreinigung.de

dinecorp.com

hawthornsretirement.co.uk

kerstliedjeszingen.nl

Attributes

net
false
pid
16
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
2932

Extracted

Family

sodinokibi

Botnet

$2a$10$nWPIRSot/CckTPp00tnXQOFn2NS9abxBEdAbLQPH5CRiCW8.CQOuG

Campaign

3382

Decoy

bouldercafe-wuppertal.de

i-arslan.de

chavesdoareeiro.com

work2live.de

rehabilitationcentersinhouston.net

mirjamholleman.nl

pogypneu.sk

babcockchurch.org

lorenacarnero.com

schlafsack-test.net

c-a.co.in

lapinvihreat.fi

smart-light.co.uk

craigvalentineacademy.com

lange.host

amerikansktgodis.se

blacksirius.de

desert-trails.com

exenberger.at

hrabritelefon.hr