General

  • Target

    12e909e5100008b26ffde5a2a0f31f2c20b13e3f23a594d0e0d64eb7129fa375

  • Size

    60KB

  • Sample

    241219-bgen1szmfy

  • MD5

    578b2dd255a8d491fec23bce4303e786

  • SHA1

    4f66e8ab43418caf432d85a789e341c55f3fce9b

  • SHA256

    12e909e5100008b26ffde5a2a0f31f2c20b13e3f23a594d0e0d64eb7129fa375

  • SHA512

    20945a43ea8b7fb5cd77cbcf2fa695b4132a5260e9adee3049fdd9f662cdac99b7fe2a02f9484d16bbfe16437d1861e1359b5db72898cc4037b898ecb140accb

  • SSDEEP

    1536:+s27bk4Psu4M1k7e6LUz/KWMYUWXhJjkZ:+JAduIxLU7/MShBkZ

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\!!!READ TO RECOVER YOUR DATA!!!.txt

Family

moisha

Ransom Note
##~~~#~~~~~####~~~~~######~~~~~####~~~~~##~~##~~~~~####~ ###~##~~~~##~~##~~~~~~##~~~~~~##~~~~~~~~##~~##~~~~##~~## ##~#~#~~~~##~~##~~~~~~##~~~~~~~####~~~~~######~~~~###### ##~~~#~~~~##~~##~~~~~~##~~~~~~~~~~##~~~~##~~##~~~~##~~## ##~~~#~~~~~####~~~~~######~~~~~####~~~~~##~~##~~~~##~~## Hi Jewels Infosystems, this is Moisha! What happened? All just our Poles Testers team penetrated your network! What do we want? We want money for our silence and decrypting your files! What did we do?, We entered your corporate network, stole your work files among them the source codes of your projects! Leaving, we encrypted them, more than you are sure of you have their copy! What do we do? We will contact your every client, and let us inform you that you were hacked and all your customers are now at risk working with the programs of whose source code we have! What to do that all this would not be and return all to places? All we just want money, namely 55.5555 dollars, for our silence and decryption of your network. What will happen if you do not get in touch? : 1. We will publish part of the source of your projects (this will cause reputational harm to your company) 2. We will sell part of the sources to your competitors or anyone who wants to buy them! 3. We are knitted with everyone who works with you or has any connection with your company, be your partners or clients of your company. 4. We will report to regional news that you were hacked! All this can be avoided, how? 1. You get in touch with us. 2. We agree in the first 48 hours it will be fast! 3. You pay the agreed amount. 4. We restore everything that we encrypted. 5. We will return your source codes to you and will not publish them on forums and sell them to second and third parties. Make sure that we are not the time you wash, looking at the provider’s report and understand that all your sources and projects merged from you !! We have downloaded all your program sources! over 200 gigabytes! Don't delay! we are waiting for you at the negotiations, we will be able to confirm the availability of your files! You can contact us: To quickly communicate, use mail ([email protected] [email protected]) - Use the Tox Messenger, You Can download heere https://tox.chat/ to comunicate with the Operator Via Tox Messenger: Moisha Id Operator in Tox Messenger 693E9B36480678C055555A135337A72913FA16FA704919191919BCEBDFC647ACB0BCACF160AA408304642B Sincerely MOISHA !! ##~~~#~~~~~####~~~~~######~~~~~####~~~~~##~~##~~~~~####~~~~~##~~~~~~####~~~####~~##~~## ###~##~~~~##~~##~~~~~~##~~~~~~##~~~~~~~~##~~##~~~~##~~##~~~~##~~~~~##~~##~##~~##~##~##~ ##~#~#~~~~##~~##~~~~~~##~~~~~~~####~~~~~######~~~~######~~~~##~~~~~##~~##~##~~~~~####~~ ##~~~#~~~~##~~##~~~~~~##~~~~~~~~~~##~~~~##~~##~~~~##~~##~~~~##~~~~~##~~##~##~~##~##~##~ ##~~~#~~~~~####~~~~~######~~~~~####~~~~~##~~##~~~~##~~##~~~~######~~####~~~####~~##~~##
URLs

https://tox.chat/

Targets

    • Target

      12e909e5100008b26ffde5a2a0f31f2c20b13e3f23a594d0e0d64eb7129fa375

    • Size

      60KB

    • MD5

      578b2dd255a8d491fec23bce4303e786

    • SHA1

      4f66e8ab43418caf432d85a789e341c55f3fce9b

    • SHA256

      12e909e5100008b26ffde5a2a0f31f2c20b13e3f23a594d0e0d64eb7129fa375

    • SHA512

      20945a43ea8b7fb5cd77cbcf2fa695b4132a5260e9adee3049fdd9f662cdac99b7fe2a02f9484d16bbfe16437d1861e1359b5db72898cc4037b898ecb140accb

    • SSDEEP

      1536:+s27bk4Psu4M1k7e6LUz/KWMYUWXhJjkZ:+JAduIxLU7/MShBkZ

    • Moisha

      Moisha is a ransomware family first seen in August 2022.

    • Moisha family

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v15

Tasks