Overview

overview

10

Static

static

3

PackedEncryptor.exe

windows7-x64

10

PackedEncryptor.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PackedEncryptor.exe

  • Size

    485KB

  • Sample

    250126-r2taxatqcx

  • MD5

    0f30d0d58dcc450cb0b05f1f84916cbb

  • SHA1

    16033c2fe6c2149b8a23f5d7e01d30cdc73687b1

  • SHA256

    14b9941d53f382c49d9ab75b8ec086210c17b19ffac0d071f462c4bfa8b5157a

  • SHA512

    b101e4cd57fbe9e5b1636a9bac0b70f8cd3d4151b40b0c464dc9616fd192efee7e11458ce92d847b1e9879cb6f2eec17838f8d4b437a832c24cc504628d43ea3

  • SSDEEP

    12288:syveQB/fTHIGaPkKEYzURNAgbAggkFLz8qd2:suDXTIGaPhEYzUzAktFX8x

Score
10/10
lockbitdefense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\RlWCfyLxZ.README.txt

Ransom Note
======================================== !!! ATTENTION !!! Your Files Have Been Encrypted by ManiaCrypt ======================================== What Happened? -------------- All of your important files, documents, photos, and databases have been encrypted using RSA. Without our decryption program, your files cannot be restored. Why Trust Us: -------------------- If we dont give you the decryption program after payment, nobody will trust us. What You Need to Do: -------------------- To get the decryption program, you must contact us. Steps to Restore Your Files: ---------------------------- 1. Open Discord and add the username ballets4. 2. Send us a message and mention your situation. 3. We will provide further instructions for obtaining the decryption program. Important Information: ----------------------- - DO NOT attempt to recover your files using third-party tools. They may damage your data and make recovery impossible. - DO NOT rename, move, or modify the encrypted files. This will also make decryption impossible. - Only we have the tools required to decrypt your files safely and effectively. We are waiting for your message. Time is critical. ======================================== Your Files. Your Responsibility. ========================================

Targets

    • Target

      PackedEncryptor.exe

    • Size

      485KB

    • MD5

      0f30d0d58dcc450cb0b05f1f84916cbb

    • SHA1

      16033c2fe6c2149b8a23f5d7e01d30cdc73687b1

    • SHA256

      14b9941d53f382c49d9ab75b8ec086210c17b19ffac0d071f462c4bfa8b5157a

    • SHA512

      b101e4cd57fbe9e5b1636a9bac0b70f8cd3d4151b40b0c464dc9616fd192efee7e11458ce92d847b1e9879cb6f2eec17838f8d4b437a832c24cc504628d43ea3

    • SSDEEP

      12288:syveQB/fTHIGaPkKEYzURNAgbAggkFLz8qd2:suDXTIGaPhEYzUzAktFX8x

    Score
    10/10
    lockbitdefense_evasiondiscoveryransomwarespywarestealer

    • Lockbit

      Ransomware family with multiple variants released since late 2019.

      ransomwarelockbit

    • Lockbit family

      lockbit

    • Rule to detect Lockbit 3.0 ransomware Windows payload

    • Renames multiple (321) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks