General

  • Target

    RNSM00337.7z

  • Size

    4.1MB

  • Sample

    241111-zem5dawcjj

  • MD5

    4cb91b29c77e16b381c510e008f8b9b5

  • SHA1

    34ec03f93f1c8de64fe59988f47762d6f4b9beda

  • SHA256

    e7c71bd7485c55cee4e7db25051be38827cc70892f37b4eb452e7990be0deacf

  • SHA512

    6333c6f2ce7066ab207e625f5a2aae6777efd7bca9f49d67c3c129fdb1aa6b74d2ae361bf2c161da667c79d7366d288edd1e0c89856290e3d03a9925bc1fac80

  • SSDEEP

    98304:EcOAE5Imy2vZfqAd9JiamPMmwQuRMIiNY+Vf09eCOL:EcOAew29/QamPM5xjiS+J09ehL

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.free3v.net
  • Port:
    21
  • Username:
    money8
  • Password:
    12345678

Extracted

Path

C:\Users\Admin\Music\#Decrypt_Files_ReadMe#.rtf

Ransom Note
{\rtf1\ansi\ansicpg1251\deff0\deflang1049{\fonttbl{\f0\fnil\fcharset0 Calibri;}{\f1\fnil\fcharset204 Calibri;}} {\colortbl ;\red0\green0\blue255;\red255\green0\blue0;\red255\green255\blue255;} {\*\generator Msftedit 5.41.21.2510;}\viewkind4\uc1\pard\ri-500\sa200\sl240\slmult1\qc\tx8804\lang1033\b\f0\fs28 WHAT HAPPENED WITH YOUR FILES?\lang1049\f1\par \pard\ri-74\sa200\sl240\slmult1\tx8378\lang1033\b0\f0\fs24 Your documents, databases, backups, network folders and other important files are encrypted with RSA-2048 and AES-128 ciphers.\par \pard\ri-74\sl240\slmult1\tx8378 More information about the RSA and AES can be found here:\par {\field{\*\fldinst{HYPERLINK "http://en.wikipedia.org/wiki/RSA_(cryptosystem"}}{\fldrslt{\ul\cf1 http://en.wikipedia.org/wiki/RSA_(cryptosystem}}}\f0\fs24 )\par \pard\ri-74\sa200\sl240\slmult1\tx8378{\field{\*\fldinst{HYPERLINK "http://en.wikipedia.org/wiki/Advanced_Encryption_Standard"}}{\fldrslt{\ul\cf1 http://en.wikipedia.org/wiki/Advanced_Encryption_Standard}}}\f0\fs24\par It m\lang1049\f1\'e5\'e0\lang1033\f0 ns th\lang1049\f1\'e0\lang1033\f0 t y\lang1049\f1\'ee\lang1033\f0 u will n\lang1049\f1\'ee\lang1033\f0 t b\lang1049\f1\'e5\lang1033\f0 \lang1049\f1\'e0\lang1033\f0 bl\lang1049\f1\'e5\lang1033\f0 t\lang1049\f1\'ee\lang1033\f0 \lang1049\f1\'e0\lang1033\f0 cc\lang1049\f1\'e5\lang1033\f0 ss th\lang1049\f1\'e5\lang1033\f0 m \lang1049\f1\'e0\lang1033\f0 n\lang1049\f1\'f3\lang1033\f0 m\lang1049\f1\'ee\lang1033\f0 r\lang1049\f1\'e5\lang1033\f0 until th\lang1049\f1\'e5\'f3\lang1033\f0 \lang1049\f1\'e0\lang1033\f0 r\lang1049\f1\'e5\lang1033\f0 d\lang1049\f1\'e5\'f1\lang1033\f0 r\lang1049\f1\'f3\lang1033\f0 pt\lang1049\f1\'e5\lang1033\f0 d with y\lang1049\f1\'ee\lang1033\f0 ur p\lang1049\f1\'e5\lang1033\f0 rs\lang1049\f1\'ee\lang1033\f0 n\lang1049\f1\'e0\lang1033\f0 l d\lang1049\f1\'e5\'f1\lang1033\f0 r\lang1049\f1\'f3\lang1033\f0 pti\lang1049\f1\'ee\lang1033\f0 n k\lang1049\f1\'e5\lang1033\f0 y! With\lang1049\f1\'ee\lang1033\f0 ut \lang1049\f1\'f3\'ee\lang1033\f0 ur p\lang1049\f1\'e5\lang1033\f0 rs\lang1049\f1\'ee\lang1033\f0 n\lang1049\f1\'e0\lang1033\f0 l k\lang1049\f1\'e5\lang1033\f0 y \lang1049\f1\'e0\lang1033\f0 nd s\lang1049\f1\'f0\'e5\lang1033\f0 ci\lang1049\f1\'e0\lang1033\f0 l s\lang1049\f1\'ee\lang1033\f0 ftw\lang1049\f1\'e0\lang1033\f0 r\lang1049\f1\'e5\lang1033\f0 d\lang1049\f1\'e0\lang1033\f0 t\lang1049\f1\'e0\lang1033\f0 r\lang1049\f1\'e5\lang1033\f0 c\lang1049\f1\'ee\lang1033\f0 v\lang1049\f1\'e5\lang1033\f0 r\lang1049\f1\'f3\lang1033\f0 is imp\lang1049\f1\'ee\lang1033\f0 ssibl\lang1049\f1\'e5\lang1033\f0 ! If y\lang1049\f1\'ee\lang1033\f0 u will f\lang1049\f1\'ee\lang1033\f0 ll\lang1049\f1\'ee\lang1033\f0 w \lang1049\f1\'ee\lang1033\f0 ur instru\lang1049\f1\'f1\lang1033\f0 ti\lang1049\f1\'ee\lang1033\f0 ns, w\lang1049\f1\'e5\lang1033\f0 gu\lang1049\f1\'e0\lang1033\f0 r\lang1049\f1\'e0\lang1033\f0 nt\lang1049\f1\'e5\'e5\lang1033\f0 th\lang1049\f1\'e0\lang1033\f0 t y\lang1049\f1\'ee\lang1033\f0 u c\lang1049\f1\'e0\lang1033\f0 n d\lang1049\f1\'e5\'f1\lang1033\f0 ry\lang1049\f1\'f0\lang1033\f0 t \lang1049\f1\'e0\lang1033\f0 ll y\lang1049\f1\'ee\lang1033\f0 ur fil\lang1049\f1\'e5\lang1033\f0 s qui\lang1049\f1\'f1\lang1033\f0 kly \lang1049\f1\'e0\lang1033\f0 nd s\lang1049\f1\'e0\lang1033\f0 f\lang1049\f1\'e5\lang1033\f0 ly!\par \pard\ri-74\sl240\slmult1\tx8378 =====================================================================\par \pard\ri-74\sa200\sl240\slmult1\tx8378\lang1049\f1\'d3\'ee\lang1033\f0 u r\lang1049\f1\'e5\'e0\lang1033\f0 l\lang1049\f1\'f3\lang1033\f0 w\lang1049\f1\'e0\lang1033\f0 nt t\lang1049\f1\'ee\lang1033\f0 r\lang1049\f1\'e5\lang1033\f0 st\lang1049\f1\'ee\lang1033\f0 r\lang1049\f1\'e5\lang1033\f0 y\lang1049\f1\'ee\lang1033\f0 ur fil\lang1049\f1\'e5\lang1033\f0 s? Pl\lang1049\f1\'e5\'e0\lang1033\f0 s\lang1049\f1\'e5\lang1033\f0 writ\lang1049\f1\'e5\lang1033\f0 us t\lang1049\f1\'ee\lang1033\f0 th\lang1049\f1\'e5\lang1033\f0 \lang1049\f1\'e5\lang1033\f0 -m\lang1049\f1\'e0\lang1033\f0 ils:\par \pard\sl240\slmult1\b\fs28 [email protected]\par [email protected]\par \pard\sa200\sl240\slmult1 [email protected]\par \b0\fs24 In subj\lang1049\f1\'e5\lang1033\f0 ct lin\lang1049\f1\'e5 \'ee\lang1033\f0 f your m\lang1049\f1\'e5\lang1033\f0 ss\lang1049\f1\'e0\lang1033\f0 g\lang1049\f1\'e5\lang1033\f0 writ\lang1049\f1\'e5\lang1033\f0 y\lang1049\f1\'ee\lang1033\f0 ur p\lang1049\f1\'e5\lang1033\f0 rs\lang1049\f1\'ee\lang1033\f0 n\lang1049\f1\'e0\lang1033\f0 l ID:\par \b\fs28 513131DFA1F6864E\par \cf2 W\lang1049\f1\'e5\lang1033\f0 r\lang1049\f1\'e5\'f1\'ee\lang1033\f0 mm\lang1049\f1\'e5\lang1033\f0 nd y\lang1049\f1\'ee\lang1033\f0 u t\lang1049\f1\'ee\lang1033\f0 s\lang1049\f1\'e5\lang1033\f0 nd y\lang1049\f1\'ee\lang1033\f0 ur m\lang1049\f1\'e5\lang1033\f0 ss\lang1049\f1\'e0\lang1033\f0 g\lang1049\f1\'e5\lang1033\f0 \lang1049\f1\'ce\lang1033\f0 N \lang1049\f1\'c5\'c0\'d1\lang1033\f0 H \lang1049\f1\'ee\lang1033\f0 f \lang1049\f1\'ce\lang1033\f0 UR 3 \lang1049\f1\'c5\'cc\'c0\lang1033\f0 ILS, du\lang1049\f1\'e5\lang1033\f0 t\lang1049\f1\'ee\lang1033\f0 th\lang1049\f1\'e5\lang1033\f0 f\lang1049\f1\'e0\'f1\lang1033\f0 t th\lang1049\f1\'e0\lang1033\f0 t th\lang1049\f1\'e5\lang1033\f0 m\lang1049\f1\'e5\lang1033\f0 ss\lang1049\f1\'e0\lang1033\f0 g\lang1049\f1\'e5\lang1033\f0 m\lang1049\f1\'e0\'f3\lang1033\f0 n\lang1049\f1\'ee\lang1033\f0 t r\lang1049\f1\'e5\'e0\lang1033\f0 ch th\lang1049\f1\'e5\lang1033\f0 ir int\lang1049\f1\'e5\lang1033\f0 nd\lang1049\f1\'e5\lang1033\f0 d r\lang1049\f1\'e5\lang1033\f0 cipi\lang1049\f1\'e5\lang1033\f0 nt f\lang1049\f1\'ee\lang1033\f0 r \lang1049\f1\'e0\lang1033\f0 v\lang1049\f1\'e0\lang1033\f0 ri\lang1049\f1\'e5\lang1033\f0 t\lang1049\f1\'f3\lang1033\f0 \lang1049\f1\'ee\lang1033\f0 f r\lang1049\f1\'e5\'e0\lang1033\f0 s\lang1049\f1\'ee\lang1033\f0 ns!\cf0\par \pard\ri-74\sl240\slmult1\tx8378\b0\fs24 =====================================================================\par \pard\ri-74\sa200\sl240\slmult1\tx8378 If \lang1049\f1\'f3\'ee\lang1033\f0 u pr\lang1049\f1\'e5\lang1033\f0 f\lang1049\f1\'e5\lang1033\f0 r liv\lang1049\f1\'e5\lang1033\f0 m\lang1049\f1\'e5\lang1033\f0 ss\lang1049\f1\'e0\lang1033\f0 ging y\lang1049\f1\'ee\lang1033\f0 u c\lang1049\f1\'e0\lang1033\f0 n s\lang1049\f1\'e5\lang1033\f0 nd us Bitm\lang1049\f1\'e5\lang1033\f0 nss\lang1049\f1\'e0\lang1033\f0 g\lang1049\f1\'e5\lang1033\f0 s fr\lang1049\f1\'ee\lang1033\f0 m \lang1049\f1\'e0\lang1033\f0 w\lang1049\f1\'e5\lang1033\f0 b br\lang1049\f1\'ee\lang1033\f0 ws\lang1049\f1\'e5\lang1033\f0 r thr\lang1049\f1\'ee\lang1033\f0 ugh th\lang1049\f1\'e5\lang1033\f0 w\lang1049\f1\'e5\lang1033\f0 bp\lang1049\f1\'e0\lang1033\f0 g\lang1049\f1\'e5\lang1033\f0 {\field{\*\fldinst{HYPERLINK "https://bitmsg.me"}}{\fldrslt{\ul\cf1 https://bitmsg.me}}}\f0\fs24 . B\lang1049\f1\'e5\lang1033\f0 l\lang1049\f1\'ee\lang1033\f0 w is \lang1049\f1\'e0\lang1033\f0 tut\lang1049\f1\'ee\lang1033\f0 ri\lang1049\f1\'e0\lang1033\f0 l \lang1049\f1\'ee\lang1033\f0 n h\lang1049\f1\'ee\lang1033\f0 w t\lang1049\f1\'ee\lang1033\f0 s\lang1049\f1\'e5\lang1033\f0 nd bitm\lang1049\f1\'e5\lang1033\f0 ss\lang1049\f1\'e0\lang1033\f0 g\lang1049\f1\'e5\lang1033\f0 vi\lang1049\f1\'e0\lang1033\f0 w\lang1049\f1\'e5\lang1033\f0 b br\lang1049\f1\'ee\lang1033\f0 ws\lang1049\f1\'e5\lang1033\f0 r:\par 1. \lang1049\f1\'ce\lang1033\f0 p\lang1049\f1\'e5\lang1033\f0 n in y\lang1049\f1\'ee\lang1033\f0 ur br\lang1049\f1\'ee\lang1033\f0 ws\lang1049\f1\'e5\lang1033\f0 r th\lang1049\f1\'e5\lang1033\f0 link {\field{\*\fldinst{HYPERLINK "https://bitmsg.me/users/sign_up"}}{\fldrslt{\ul\cf1 https://bitmsg.me/users/sign_up}}}\f0\fs24 \lang1049\f1\'e0\lang1033\f0 nd m\lang1049\f1\'e0\lang1033\f0 k\lang1049\f1\'e5\lang1033\f0 th\lang1049\f1\'e5\lang1033\f0 r\lang1049\f1\'e5\lang1033\f0 gistr\lang1049\f1\'e0\lang1033\f0 ti\lang1049\f1\'ee\lang1033\f0 n b\lang1049\f1\'f3\lang1033\f0 \lang1049\f1\'e5\lang1033\f0 nt\lang1049\f1\'e5\lang1033\f0 ring n\lang1049\f1\'e0\lang1033\f0 m\lang1049\f1\'e5\lang1033\f0 \lang1049\f1\'e5\lang1033\f0 m\lang1049\f1\'e0\lang1033\f0 il \lang1049\f1\'e0\lang1033\f0 nd p\lang1049\f1\'e0\lang1033\f0 ssw\lang1049\f1\'ee\lang1033\f0 rd.\par 2. \lang1049\f1\'d3\'ee\lang1033\f0 u must c\lang1049\f1\'ee\lang1033\f0 nfirm th\lang1049\f1\'e5\lang1033\f0 r\lang1049\f1\'e5\lang1033\f0 gistr\lang1049\f1\'e0\lang1033\f0 ti\lang1049\f1\'ee\lang1033\f0 n, r\lang1049\f1\'e5\lang1033\f0 turn t\lang1049\f1\'ee\lang1033\f0 \lang1049\f1\'f3\'ee\lang1033\f0 ur \lang1049\f1\'e5\lang1033\f0 m\lang1049\f1\'e0\lang1033\f0 il \lang1049\f1\'e0\lang1033\f0 nd f\lang1049\f1\'ee\lang1033\f0 ll\lang1049\f1\'ee\lang1033\f0 w th\lang1049\f1\'e5\lang1033\f0 instructi\lang1049\f1\'ee\lang1033\f0 ns th\lang1049\f1\'e0\lang1033\f0 t w\lang1049\f1\'e5\lang1033\f0 r\lang1049\f1\'e5\lang1033\f0 s\lang1049\f1\'e5\lang1033\f0 nt t\lang1049\f1\'ee\lang1033\f0 \lang1049\f1\'f3\'ee\lang1033\f0 u.\par 3. R\lang1049\f1\'e5\lang1033\f0 turn t\lang1049\f1\'ee\lang1033\f0 sit\lang1049\f1\'e5\lang1033\f0 \lang1049\f1\'e0\lang1033\f0 nd \lang1049\f1\'f1\lang1033\f0 lick \lang1049\f1 "\lang1033\f0 L\lang1049\f1\'ee\lang1033\f0 gin\lang1049\f1 "\lang1033\f0 l\lang1049\f1\'e0\lang1033\f0 b\lang1049\f1\'e5\lang1033\f0 l \lang1049\f1\'ee\lang1033\f0 r us\lang1049\f1\'e5\lang1033\f0 link {\field{\*\fldinst{HYPERLINK "https://bitmsg.me/users/sign_in"}}{\fldrslt{\ul\cf1 https://bitmsg.me/users/sign_in}}}\f0\fs24 , \lang1049\f1\'e5\lang1033\f0 nt\lang1049\f1\'e5\lang1033\f0 r \lang1049\f1\'f3\'ee\lang1033\f0 ur \lang1049\f1\'e5\lang1033\f0 m\lang1049\f1\'e0\lang1033\f0 il \lang1049\f1\'e0\lang1033\f0 nd p\lang1049\f1\'e0\lang1033\f0 ssw\lang1049\f1\'ee\lang1033\f0 rd \lang1049\f1\'e0\lang1033\f0 nd click th\lang1049\f1\'e5\lang1033\f0 "Sign in" butt\lang1049\f1\'ee\lang1033\f0 n. \lang1049\f1 \lang1033\f0\par 4. \lang1049\f1\'d1\lang1033\f0 lick th\lang1049\f1\'e5\lang1033\f0 "\lang1049\f1\'d1\lang1033\f0 r\lang1049\f1\'e5\'e0\lang1033\f0 t\lang1049\f1\'e5\lang1033\f0 R\lang1049\f1\'e0\lang1033\f0 nd\lang1049\f1\'ee\lang1033\f0 m \lang1049\f1\'e0\lang1033\f0 ddr\lang1049\f1\'e5\lang1033\f0 ss" butt\lang1049\f1\'ee\lang1033\f0 n.\par 5. \lang1049\f1\'d1\lang1033\f0 lick th\lang1049\f1\'e5\lang1033\f0 "N\lang1049\f1\'e5\lang1033\f0 w m\lang1049\f1\'e0\lang1033\f0 ss\lang1049\f1\'e0\lang1033\f0 g\lang1049\f1\'e5\lang1033\f0 " butt\lang1049\f1\'ee\lang1033\f0 n.\par \b S\lang1049\f1\'e5\lang1033\f0 nding m\lang1049\f1\'e5\lang1033\f0 ss\lang1049\f1\'e0\lang1033\f0 g\lang1049\f1\'e5\lang1033\f0 :\par T\lang1049\f1\'ee\lang1033\f0 :\b0 \lang1049\f1\'c5\lang1033\f0 nt\lang1049\f1\'e5\lang1033\f0 r \lang1049\f1\'e0\lang1033\f0 ddr\lang1049\f1\'e5\lang1033\f0 ss: \b BM-2cVeq4HtLaXPGTamXgv5rvwDjypapmy8ir\par \pard\sa200\sl240\slmult1 Subj\lang1049\f1\'e5\'f1\lang1033\f0 t:\b0 \lang1049\f1\'c5\lang1033\f0 nt\lang1049\f1\'e5\lang1033\f0 r \lang1049\f1\'f3\'ee\lang1033\f0 ur ID: \b 513131DFA1F6864E\par M\lang1049\f1\'e5\lang1033\f0 ss\lang1049\f1\'e0\lang1033\f0 g\lang1049\f1\'e5\lang1033\f0 : \b0 D\lang1049\f1\'e5\lang1033\f0 scrib\lang1049\f1\'e5\lang1033\f0 wh\lang1049\f1\'e0\lang1033\f0 t \lang1049\f1\'f3\'ee\lang1033\f0 u think n\lang1049\f1\'e5\lang1033\f0 c\lang1049\f1\'e5\lang1033\f0 ss\lang1049\f1\'e0\lang1033\f0 r\lang1049\f1\'f3\lang1033\f0 .\par \pard\ri-74\sa200\sl240\slmult1\tx8378\lang1049\f1\'d1\lang1033\f0 lick th\lang1049\f1\'e5\lang1033\f0 "S\lang1049\f1\'e5\lang1033\f0 nd m\lang1049\f1\'e5\lang1033\f0 ss\lang1049\f1\'e0\lang1033\f0 g\lang1049\f1\'e5\lang1033\f0 " butt\lang1049\f1\'ee\lang1033\f0 n.\par \pard\ri-74\sl240\slmult1\tx8378 =====================================================================\par \pard\sa200\sl240\slmult1\cf2\b\fs28 Pl\lang1049\f1\'e5\'e0\lang1033\f0 s\lang1049\f1\'e5\lang1033\f0 , writ\lang1049\f1\'e5\lang1033\f0 us in \lang1049\f1\'c5\lang1033\f0 nglish \lang1049\f1\'ee\lang1033\f0 r us\lang1049\f1\'e5\lang1033\f0 pr\lang1049\f1\'ee\lang1033\f0 f\lang1049\f1\'e5\lang1033\f0 ssi\lang1049\f1\'ee\lang1033\f0 n\lang1049\f1\'e0\lang1033\f0 l tr\lang1049\f1\'e0\lang1033\f0 nsl\lang1049\f1\'e0\lang1033\f0 t\lang1049\f1\'ee\lang1033\f0 r!\par \pard\ri-74\sa200\sl240\slmult1\tx8378 If y\lang1049\f1\'ee\lang1033\f0 u w\lang1049\f1\'e0\lang1033\f0 nt t\lang1049\f1\'ee\lang1033\f0 r\lang1049\f1\'e5\lang1033\f0 st\lang1049\f1\'ee\lang1033\f0 r\lang1049\f1\'e5\lang1033\f0 y\lang1049\f1\'ee\lang1033\f0 ur fil\lang1049\f1\'e5\lang1033\f0 s, y\lang1049\f1\'ee\lang1033\f0 u h\lang1049\f1\'e0\lang1033\f0 v\lang1049\f1\'e5\lang1033\f0 t\lang1049\f1\'ee\lang1033\f0 p\lang1049\f1\'e0\lang1033\f0 y f\lang1049\f1\'ee\lang1033\f0 r d\lang1049\f1\'e5\'f1\lang1033\f0 r\lang1049\f1\'f3\lang1033\f0 pti\lang1049\f1\'ee\lang1033\f0 n in Bit\lang1049\f1\'f1\'ee\lang1033\f0 ins or with \lang1049\f1\'ee\lang1033\f0 th\lang1049\f1\'e5\lang1033\f0 r top \lang1049\f1\'f1\lang1033\f0 r\lang1049\f1\'f3\lang1033\f0 pt\lang1049\f1\'ee\'f1\lang1033\f0 urr\lang1049\f1\'e5\lang1033\f0 nc\lang1049\f1\'f3\lang1033\f0 .\par Th\lang1049\f1\'e5\lang1033\f0 pric\lang1049\f1\'e5\lang1033\f0 d\lang1049\f1\'e5\'f0\'e5\lang1033\f0 nds \lang1049\f1\'ee\lang1033\f0 n h\lang1049\f1\'ee\lang1033\f0 w f\lang1049\f1\'e0\lang1033\f0 st \lang1049\f1\'f3\'ee\lang1033\f0 u writ\lang1049\f1\'e5\lang1033\f0 t\lang1049\f1\'ee\lang1033\f0 us!\par \pard\sa200\sl240\slmult1\cf0\b0\fs24 Your message will be as confirmation you are ready to pay for decryption key. After the payment you will get the decryption tool with instructions that will decrypt all your files including network folders.\par T\lang1049\f1\'ee\lang1033\f0 c\lang1049\f1\'ee\lang1033\f0 nfirm th\lang1049\f1\'e0\lang1033\f0 t w\lang1049\f1\'e5\lang1033\f0 c\lang1049\f1\'e0\lang1033\f0 n d\lang1049\f1\'e5\'f1\lang1033\f0 ry\lang1049\f1\'f0\lang1033\f0 t y\lang1049\f1\'ee\lang1033\f0 ur fil\lang1049\f1\'e5\lang1033\f0 s y\lang1049\f1\'ee\lang1033\f0 u c\lang1049\f1\'e0\lang1033\f0 n s\lang1049\f1\'e5\lang1033\f0 nd us up t\lang1049\f1\'ee\lang1033\f0 3 fil\lang1049\f1\'e5\lang1033\f0 s f\lang1049\f1\'ee\lang1033\f0 r fr\lang1049\f1\'e5\'e5\lang1033\f0 d\lang1049\f1\'e5\'f1\lang1033\f0 r\lang1049\f1\'f3\'f0\lang1033\f0 ti\lang1049\f1\'ee\lang1033\f0 n. Pl\lang1049\f1\'e5\'e0\lang1033\f0 s\lang1049\f1\'e5\lang1033\f0 n\lang1049\f1\'ee\lang1033\f0 te th\lang1049\f1\'e0\lang1033\f0 t fil\lang1049\f1\'e5\lang1033\f0 s f\lang1049\f1\'ee\lang1033\f0 r fr\lang1049\f1\'e5\'e5\lang1033\f0 d\lang1049\f1\'e5\'f1\lang1033\f0 r\lang1049\f1\'f3\'f0\lang1033\f0 ti\lang1049\f1\'ee\lang1033\f0 n must N\lang1049\f1\'ce\lang1033\f0 T c\lang1049\f1\'ee\lang1033\f0 nt\lang1049\f1\'e0\lang1033\f0 in \lang1049\f1\'e0\lang1033\f0 n\lang1049\f1\'f3\lang1033\f0 v\lang1049\f1\'e0\lang1033\f0 lu\lang1049\f1\'e0\lang1033\f0 bl\lang1049\f1\'e5\lang1033\f0 inf\lang1049\f1\'ee\lang1033\f0 rm\lang1049\f1\'e0\lang1033\f0 ti\lang1049\f1\'ee\lang1033\f0 n \lang1049\f1\'e0\lang1033\f0 nd th\lang1049\f1\'e5\lang1033\f0 ir t\lang1049\f1\'ee\lang1033\f0 t\lang1049\f1\'e0\lang1033\f0 l siz\lang1049\f1\'e5\lang1033\f0 must b\lang1049\f1\'e5\lang1033\f0 l\lang1049\f1\'e5\lang1033\f0 ss th\lang1049\f1\'e0\lang1033\f0 n 5Mb.\par Y\lang1049\f1\'ee\lang1033\f0 u h\lang1049\f1\'e0\lang1033\f0 v\lang1049\f1\'e5\lang1033\f0 t\lang1049\f1\'ee\lang1033\f0 r\lang1049\f1\'e5\lang1033\f0 sp\lang1049\f1\'ee\lang1033\f0 nd \lang1049\f1\'e0\lang1033\f0 s s\lang1049\f1\'ee\'ee\lang1033\f0 n \lang1049\f1\'e0\lang1033\f0 s p\lang1049\f1\'ee\lang1033\f0 ssibl\lang1049\f1\'e5\lang1033\f0 t\lang1049\f1\'ee\lang1033\f0 \lang1049\f1\'e5\lang1033\f0 nsur\lang1049\f1\'e5\lang1033\f0 th\lang1049\f1\'e5\lang1033\f0 r\lang1049\f1\'e5\lang1033\f0 st\lang1049\f1\'ee\lang1033\f0 r\lang1049\f1\'e0\lang1033\f0 ti\lang1049\f1\'ee\lang1033\f0 n\lang1049\f1 \'ee\lang1033\f0 f y\lang1049\f1\'ee\lang1033\f0 ur fil\lang1049\f1\'e5\lang1033\f0 s, b\lang1049\f1\'e5\lang1033\f0 c\lang1049\f1\'e0\lang1033\f0 us\lang1049\f1\'e5\lang1033\f0 w\lang1049\f1\'e5\lang1033\f0 w\lang1049\f1\'ee\lang1033\f0 nt k\lang1049\f1\'e5\'e5\lang1033\f0 p y\lang1049\f1\'ee\lang1033\f0 ur d\lang1049\f1\'e5\lang1033\f0 cr\lang1049\f1\'f3\lang1033\f0 pti\lang1049\f1\'ee\lang1033\f0 n k\lang1049\f1\'e5\lang1033\f0 ys \lang1049\f1\'e0\lang1033\f0 t \lang1049\f1\'ee\lang1033\f0 ur s\lang1049
URLs

https://bitmsg.me}}}\f0\fs24

https://bitmsg.me/users/sign_up}}}\f0\fs24

https://bitmsg.me/users/sign_in}}}\f0\fs24

Extracted

Path

C:\$Recycle.Bin\LSPQMCX-DECRYPT.txt

Ransom Note
---= GANDCRAB V5.0.2 =--- Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .LSPQMCX The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/b7ac704af1825434 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAEEKjl2ojlTNfCHL52YL+4xpZNh3ilFlv1Je9SiA1XdIy7GQatwzM6Nle/XCjmBKMoyQiEN6GODfkl4c6lf/8gx93wzJtcBHdUJThAx1L7fCyMenJc53qEn5WUgY+m+SUuzE3g6dChXeKTS4BlEbXHVBiP6wv8/HS5V7ssi4Rc/Wd0gsrrFyngDRc0WNXTRGDgdLMn6WFKmXzd0DBH9ocZWXGU8jRGQqtGfz/jS2b45/A1aUfXXyTu5zgRS/jnRsyS3YgHkQkFy4T0T6oEek1pEVwnFez5pgLjkDqzdTpUbhqpiX4WMrKDV4sfNuLgQc7dlMLezO7D4ggSIBxGIE1mE+Hmtg1jFDoUCIMK7y3IlZ+pSLSBDwR7q2wZItLWZVK7mG+rks+RX2yukxiew4kRpKhXGFMNbdIpjUsyFGG7q8CfrZ19AWtd1GLvZYUATKWNzTkKBB/1umDOVbkpifJ9PY8CBSTCWwO8sUmlUbC52LMkDzk4E5kgXK3RmXehZoSZSaQ2fN4KI3g85uFTxN0oHrnrEBZm8ebAmQqiZAr54sqA9PiV7bFY7w2/lksNaL8JkZ8xR2gMJHii4cmcotbHz0/GNKtlaO4ByTY30xHgECFCLKIHHbtTvFwv9GpHuO5WiN7u7v9whAxV+zvtMBq+fGOcgQKTIlzrUPIrktISFJeH5XgdON2DY6FzOcGYbkYTGkTC6CrirhawLNilPZkxXUUbpCm361v6XXi141IO/j8uuv4Okbs/n1HePiQy6h3fYQYkY8XdEUpJ1iVNKWqpSL9ml//oY/ySKePEvz6yViSXlURqi3w4kgma9gFBp7H0dyQy0dVLcddiOCqnAcd0jBQEwDPHjlU42lbGwk4orezHGeZwzIg2qTZfPVEO+7qMsYdSfR4qqEYP/SVXLu+85nPeQrGeqhgsEq7OK2DjZRdcegRU89gOJLcOkuz2BY9gEUAGnkc0gjYLaAUytOyY79gcelVlFSCrsvAjBGksyXEShm58YmpT/bLIzi+/TEBWY1JKDFfMVihKIOtRfqLiwVL8dzFDZpcE8FClN0m8Mx4crkixPEyi8ygT/sYiH1dO5d8C80G+GoCVESPueJS48ZfbW96JvyTFtiStESefYapT1FLfuSxycdEf91tdVYCvvlDDVDn8gPUWJZGaHlb7wWF8Zhd5S8iIpWe44LtkQY72EpnWJa55Q3JOcwVn0UgpW/XXFZBvnt16C0oZKALPMIg5sdN6Run0EsewdPlowOUf+WMocW1FuIN4l5Rr5D8sNl6uw+rP2k1269AiH3fOmiAKVhpO66c/7CAjrrlzIbgqXxG28x5NAEJSAUqmlj3pmGiEr9ZQDke/19a7xo+D/tHtk7zHzGXvu2wSO5fJ8YmQFJ99zGTWqs6pTAPE08Mn5sIi+zD9g6OdgbpC66HZp+Zb6qCDk+E6G/gZ7EAmE6Q4QqSFRmnbIvzcz5id1JBgxwReGkRlmVEJG1QwnkCtCeBoHZsPXYzlknMlz8DSNPRjDmFg2EGNBB65SL0Lh0ERMEI4PLvaTv1+4Ge8S/+villaAv8ANjj1O81AZsi0csTNrnjtRAOR9qnFP3cV4Oaq/n8tVs7ilr6GqsDhXKtvSQMTdiiAI3Kp8OMk3TvdEcD7f7WoPAaInqC4OKgiAySnf2T3Aqmc6owIlFuix8/JwsaBnIQvwFrfBtvvGolpw281TFURQC59cx3lSWCnVG5cpIRwlCI2ybU/xKmSwp/CNlqbyusNsfvRIFNxOswCWuKdl8FWR053u73xYact0ksZwc2wQFEP99zM0iAN0VwObHETo+MkbxshtDKSjd3EkMDNfHHRGvEb1PpOcGDARfZjCYHUb6LlLg1DOHuWvSRVx+L1cwIe24vz6b0kLCYNAo4VFjhMe/XFu+rDcyj0R6JNsV+/sj8pvY2wpdTDTepovXaP/rFb3FESqp/+3v1BcW46GwGTan45X5wb7jXwRjbEvmftcXRAP20WYrNHOtXpDvWM6ipF6DV5ISnfJ6Gzsd5twh3NTFxNkzhGiAdxh0gdNmEBOXHgsEmDDgsVbAqS8m4VBXJuNpvnkF0G4ar9lejiplvL6fHLGUe83a5QoSvctO/PlypfgUnLHxmRzhl6sWEEOajzz3TS9/OroF1g5IDC9Msoxjch8uEMHwmnzsA24tHeNu3RWwZFJoc/yjWhOxI8CmCWC7cNPnMk//sN7nWb6fpGIsw0EWgi+gnbPEaKqVJ1c= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZHTp5RunYa7m1Wt7fMTHiHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wLmpQodXZhP6M/UPrO1sZzkDbgjYlAG3g8l65nVd0/CBUxKQ7KDJYrtX0vSmnFXg/ykfgtJNiwqfCnqbr85+BisbF1kRnBs+Kj/2Y2Fet3Go1YbVqLBiXtqBHSEdobpScE4oG4b6a1Y8ZyGoyp2Q2iuJRzTRoqGlPQJIAJppFrwNIoDBPOnKw+A+5ZALufjGEwg7NrKg3qxA9Kxg70ZinpDxFF3vHLOeap1wYZLXRgRl+KCjmo1jngAX95mSffmizzQU1nmrIqlsew6HIMVY3pdDfwfAscdcBnP3FNhn9WQ3XC06ZCEvXtdUj8BYRMbJHyHp8Oar+NRZwP9okRV/rusrPFzMP9P3YDh9gzrewdRb9tHf+DbmDW4OIcXpVeLdQr9FxhOFLL2u9gwWmeLQ4zxgtafmr5TWEPiWMEkrI= ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/b7ac704af1825434

Extracted

Family

gozi

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

shadowpro87.ddns.net:1177

Mutex

9165950e91e4e361fa21d31cf1cfc39b

Attributes
  • reg_key

    9165950e91e4e361fa21d31cf1cfc39b

  • splitter

    |'|'|

Targets

    • Target

      RNSM00337.7z

    • Size

      4.1MB

    • MD5

      4cb91b29c77e16b381c510e008f8b9b5

    • SHA1

      34ec03f93f1c8de64fe59988f47762d6f4b9beda

    • SHA256

      e7c71bd7485c55cee4e7db25051be38827cc70892f37b4eb452e7990be0deacf

    • SHA512

      6333c6f2ce7066ab207e625f5a2aae6777efd7bca9f49d67c3c129fdb1aa6b74d2ae361bf2c161da667c79d7366d288edd1e0c89856290e3d03a9925bc1fac80

    • SSDEEP

      98304:EcOAE5Imy2vZfqAd9JiamPMmwQuRMIiNY+Vf09eCOL:EcOAew29/QamPM5xjiS+J09ehL

    • Gandcrab

      Gandcrab is a Trojan horse that encrypts files on a computer.

    • Gandcrab family

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

    • Gozi family

    • Matrix Ransomware

      Targeted ransomware with information collection and encryption functionality.

    • Matrix family

    • Njrat family

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Renames multiple (330) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Drops file in Drivers directory

    • Manipulates Digital Signatures

      Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Network Share Discovery

      Attempt to gather information on host network.

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    • Enumerates processes with tasklist

    • Sets desktop wallpaper using registry

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks