Resubmissions

19-02-2025 21:18

250219-z5vxxayqaw 10

19-02-2025 21:16

250219-z4evasypgx 10

General

  • Target

    https://gofile.io/d/scrqUr

  • Sample

    250219-z5vxxayqaw

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\whoisthisugly's RAT set\everything\Yashma-Ransomware-main\Yashma Ransomware\CustomWindowsForm\BlackForm.resx

Ransom Note
<?xml version="1.0" encoding="utf-8"?> <root> <!-- Microsoft ResX Schema Version 2.0 The primary goals of this format is to allow a simple XML format that is mostly human readable. The generation and parsing of the various data types are done through the TypeConverter classes associated with the data types. Example: ... ado.net/XML headers & schema ... <resheader name="resmimetype">text/microsoft-resx</resheader> <resheader name="version">2.0</resheader> <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader> <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader> <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data> <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data> <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64"> <value>[base64 mime encoded serialized .NET Framework object]</value> </data> <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64"> <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value> <comment>This is a comment</comment> </data> There are any number of "resheader" rows that contain simple name/value pairs. Each data row contains a name, and value. The row also contains a type or mimetype. Type corresponds to a .NET class that support text/value conversion through the TypeConverter architecture. Classes that don't support this are serialized and stored with the mimetype set. The mimetype is used for serialized objects, and tells the ResXResourceReader how to depersist the object. This is currently not extensible. For a given mimetype the value must be set accordingly: Note - application/x-microsoft.net.object.binary.base64 is the format that the ResXResourceWriter will generate, however the reader can read any of the formats listed below. mimetype: application/x-microsoft.net.object.binary.base64 value : The object must be serialized with : System.Runtime.Serialization.Formatters.Binary.BinaryFormatter : and then encoded with base64 encoding. mimetype: application/x-microsoft.net.object.soap.base64 value : The object must be serialized with : System.Runtime.Serialization.Formatters.Soap.SoapFormatter : and then encoded with base64 encoding. mimetype: application/x-microsoft.net.object.bytearray.base64 value : The object must be serialized into a byte array : using a System.ComponentModel.TypeConverter : and then encoded with base64 encoding. --> <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata"> <xsd:import namespace="http://www.w3.org/XML/1998/namespace" /> <xsd:element name="root" msdata:IsDataSet="true"> <xsd:complexType> <xsd:choice maxOccurs="unbounded"> <xsd:element name="metadata"> <xsd:complexType> <xsd:sequence> <xsd:element name="value" type="xsd:string" minOccurs="0" /> </xsd:sequence> <xsd:attribute name="name" use="required" type="xsd:string" /> <xsd:attribute name="type" type="xsd:string" /> <xsd:attribute name="mimetype" type="xsd:string" /> <xsd:attribute ref="xml:space" /> </xsd:complexType> </xsd:element> <xsd:element name="assembly"> <xsd:complexType> <xsd:attribute name="alias" type="xsd:string" /> <xsd:attribute name="name" type="xsd:string" /> </xsd:complexType> </xsd:element> <xsd:element name="data"> <xsd:complexType> <xsd:sequence> <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" /> <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" /> </xsd:sequence> <xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" /> <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" /> <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" /> <xsd:attribute ref="xml:space" /> </xsd:complexType> </xsd:element> <xsd:element name="resheader"> <xsd:complexType> <xsd:sequence> <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" /> </xsd:sequence> <xsd:attribute name="name" type="xsd:string" use="required" /> </xsd:complexType> </xsd:element> </xsd:choice> </xsd:complexType> </xsd:element> </xsd:schema> <resheader name="resmimetype"> <value>text/microsoft-resx</value> </resheader> <resheader name="version"> <value>2.0</value> </resheader> <resheader name="reader"> <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value> </resheader> <resheader name="writer"> <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value> </resheader> <data name="textBox1.Text" xml:space="preserve"> <value>Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)</value> </data> <metadata name="saveFileDialog1.TrayLocation" type="System.Drawing.Point, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"> <value>17, 17</value> </metadata> <metadata name="openFileDialog1.TrayLocation" type="System.Drawing.Point, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"> <value>153, 17</value> </metadata> <assembly alias="System.Drawing" name="System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /> <data name="$this.Icon" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64"> <value> AAABAAYAAAAAAAEAIABEEgAAZgAAAICAAAABACAAKAgBAKoSAABAQAAAAQAgAChCAADSGgEAMDAAAAEA IACoJQAA+lwBACAgAAABACAAqBAAAKKCAQAQEAAAAQAgAGgEAABKkwEAiVBORw0KGgoAAAANSUhEUgAA AQAAAAEACAYAAABccqhmAAASC0lEQVR42u3dW6xc113H8X+w6ySWTdy40LhF9Wml9KKklCQgEgox4CJo UzWOUN1KpQ1CRaK8kAYVUSGIKAIJkEA8hETiolR1m5A8xK6aS9MLTnpLL9gnbS2Z9qEnFOJQ4fSYpElj WoUH/38+MyuzZ9/Wvsz8vx/J+svHc/bsuXiv31p77bXNAABAPOcMvQPo3Ou8vs/rXq+f8nqX10ND7yj6 9yND7wCA4ZAAlscFXvd5/UOvr0getyX5+9PJ3z/j9XavB72eGvoFIj8SABAYCWBxpX3767zqMz2/5faf Sbbzca8kgyVCAgACIwGMX9O+fVeKksF9Xg96fbSn/UELJAAgMBLA+HTdt++KziZs9Xrc661eD3olGYwI CQAIjAQwnLH17btSlgwOe31k6B2NiAQABEYC6M+i9u27omSw2eu61494vc0ryaBDJAAgMBJAflH69l05 nfx93SvJoAMkACAwEkB79O37kSaDH3i92yvrGjRAAgACIwFUR99+3NJ1DUgGFZAAgMBIAMXo2y8HVjya gwQABEYCoG8fFSseGQkACC1iAqBvj3lCrXhEAgACW+YEQN8eOZWta/B3Q+9gEyQAILBlSgD07TGE73v9 Ha8fHHqH6iABAIEtYgKgb48x+p7Xl3pdiPkDJAAgsEVKADd7/c1k3+nbYwz+z+udXn9j6B2qggQABLYI CWCP1we80rfHmD3r9Ve9Pjj0Ds1DAgACW4QE8HmvVw29I0ANj3vdNfSOzEMCAALb3H4TnVHf/4qhdwRo QPNVbvL6p0Pv0CwkACCwMY8B0PfHMlnxOqp1BEgAQGBjTADXetV67i8YeoeAFjQv4IjXnxt6hyaRAIDA xpgATni9aOgdATIa5boBJAAgsDElgOu9ao2184beIaADo1o3gAQABDamBEDfHxGMat0AEgAQ2BgSAH1/ RDSKdQNIAEBgQyYAXS2lO6zQ90dEg64bQAIAAhtyPYAbvO4Y+k0ABjTougEkACCwIcYAdMR7zOvWphsC ltCK117WDSABAIENMQZwg1cOPsAGzQu43Wsv6wbwnxAIrM8xAPr+QLle1w0gAQCB9ZkAdHff3/LKnH+g WC/rBpAAgMD6SAC7va4N/WKBBdLLugEkACCwPhLAAa9v9bpl6BcNLJBO1w0gAQCBdZkA6PsD+XSybgAJ AAhsU4fbvtnM9prZq83shx0/F7DsNtmZuTObzewXLdNYAAkACKyLMYA9Xj/u9dyhXySwhFa8tlo3gAQA BNZFAvi816uGfnHAEtK8gCNeW60bQAIAAsuZANT3f8ArM/6A7mRZN4AEAASWMwHQ9wf612rdABIAEFiO VYHV979i6BcDBKSxNq24VWvdABIAEFiOMYATXrm7LzCcRusGkACAwNqMAVzvdcfQLwLA2Wtu7vBaad0A EgAQWJtr9O83szfYmQQwxD0GATxfrXUDSABAYE3OAqjvf6tX7vADjNeK15nrBpAAgMCaJADO+wPjV2nd ABIAEFid0fubvF4w9E4DKKV5AZd51djd1LoBJAAgsCpjAGrxH/O6deidBlDbzHUDSABAYFXGAG7wysEC WFwz1w3gPzUQ2LwxAPr+wPKZWjeABAAENm8M4AavHCSA5TG1bgD/uYHAZo0B7Pa6NvTOAejM02YkACC0 WWMAf+71tFfu8Qcsn01mJAAgtMkxgJl9/8ve/dNZnujoP35l5s+37dpuZmYXX/OqWts7ceTM9ITHjzxW 6/fkF/74l6b+/pk/+9csr7PMRZe/xMzMLi95X09+86SZmT3xjf+Zer1PnXhy6nFbtp0JaBe+8kVZ9k/P t2X7mcFifT5tbT7/TNj8sdf8eK3fa/s5Fxnqe5faf/c7zGzj/8c37/n3rK+zDAkACGxyDGBm33+Xt1i7 rnhp9a1OOOktSlECUAum59GReftLfnTm45987H/NbKMlfLzm/mj7r3zzq6d+rv1LW9hclKQu/+2fmfs+ nX7yzEQttUznvv0npx534t/+y8zM7v3dj069nivf+3ozM9vZMAno+R/6wKentnOJP3/b7R6782tmVv/7 pM/7zus+3Oj5i+jzSL8HRfS+n8jU8uvz1fdc+9NjAjhqRgIAQjvHKp73V0v9pluuNbPyFuGe9xwys/p9 pUve9lozM7vyxp83s40W4OA77zIzs9NPna61vdTPekt5adKyHvmHL5tZcVJpqqjlf9Zb+nv9fXrC+/yi lv1Nf/8WM9toKdIEkKr6OX3jY8fNrPrYR+7t1v0+feJ995mZ2X88tFb5vZ9F7+vbDs6/ia4+nwNv+OdW z1dk34feOvN153qdFZAAgOgmxwCe8rpt1gPV8qrF2u9H0HO3nztzw+rjVE0AahEuS1rKT/7B/VPP35S2 XzTqq5/nSgAXXrzTzIr7/Mfu+KqZPb/lF41FaH+u/pNfrvS8ep/UVy1qWeuOdeTerranMYKyBKDE1rZl vCRJfkV0NiQ3nQUqer25XmcFh8xIAEBom23jjiHf97pt3i/oyP3Fv/2cmRW3TBpdrTq6riOzEsXXS1rI unbvefnU9lPqYysJtB2NLWvRqraUjz74rUbPr7MJTf+96e/VHSVP3wf1vdPPSWcN1Ievm2DSBFj0PF0r m3eg16kEmev7P0Ef4LoZCQAIbXIM4KteK3U21ULqiFZ0Xlfnp9WXT+nIrASgI/NRH5XPpeqMxlwJoGwG nfqCZc+jxKWzFFsytVgn87csWWhspGjsRJ9j3ZmbacLU+1n0PLkVzT8p298OZqg+43XVjAQAhDaZAB7y Wm24Wb/kR6ii86rqe7/s6hUze/7ops7L68ismWhtR/1Fz6s+vravliSdcZirD1bWF1ZLsN1bhod9TKXo +XLPTxiLdKxECSBtsaXu2JIo2Z1Mrq3oS3r2QfNkrvF5EKmmr7MC/Z9fMyMBAKFNJoDDXte97qiyAR2Z yvpUGgvQvAD1ZXWk0wy33HOhL03GFjSqrj5Z0f627YNVnf+gxHHdgf1mtjGTTmdZciWhsdIYkOj16ntw acF5+6pjAemceyXAvl+f9kPfc30/9HkXjQ3knp9iG2f5HjUjAQChTSaAB73uaLIhHaHSI66cverJW9z0 yK8+cC5q4dXCal6BWpiy0WYdkdu2xA//zWfNbOPahjJ6Xo2dqMXKPTPs7NkbPxtRVd3HN6XPpygBVP18 9Dp1TYmSxUU9vY50/om+h+nrLEoASqLHku9vC1MTS0gAQGCz1gTUEeLlTTaoswJFo5vpET33jD9Jz/sf S468OpJW7YMd+5evNdoP/Z5GnTVzsmymoFqMX/nrN069T5of0bYlqHo+eigaWyr7fNRCpn1kncVRAjyS eV5JVfoeKoGkSU7fe40NpPNp9D1QksgwRrY++RcSABDYrASgQ2mjBFB1dLOrGX8aW0jPLhSdR9URtbQP 1jABiI70WtegbIWglJLTTm/ZitYDqKrpeg1197sttex1+8jpzNI0AXYtnX9SlkCO+Ou8pmBGbcYVg74w +RcSABDYrARwj9c3et1WcVtTylpWXW+d+zx3OuNK2y+7FqDo6jAdwYtmMjaVrgJ7ta9SXLZWXg9Xi42K kpvmb6gvLPq80iSg752SaN/zKdKxLs17GcH38DuTfyEBAIHNSgCrXn849M7VkV5VKGox0pajrrortWge gmpRX1stnPr06ZqIRXQ+ftkTgOgsSNHnqM89vVqy72so0rMPcmnFlYjKtFgxaN3r4ckfkgCAwGYlgEe8 XjD0ztWRXj2mGXRVR03LVovVEV0zyMpGzzV/QKPlH9r7T2ZW3hfV2Qa1dEVjAm3XBdDZhNx33OmK9rPs fLlaSI0ZdHWfhyJpAh36ezhBdwFbn/whCQAIbPOcfzvq9bKhd3Keor5/3bX0ykabRff0q3seXvfuq3rE Vp+3KAG0vZ4918pCfSt7X9LH9SWdf6LR/Lrn7Tv8HirRPzL5QxIAENi8BHDI66gTQNr315Gz6XnfsiNv 0z5Y3fskFF0roDnli9J3z02j33of0qtOteJP3+9PmkDbztjr4Hs480YHJAAgsHkJYNXrKa+jOiuQq++f 0pG7aM1AqdsHU99Q2y86Yus8ctEdbKqum1B2tWHTMYCy7e6qmYzS1ZOrznAsumNS1Tn/6XoUTRV9D9te e3B2hmjJHaFqfA+/PeuHJAAgsHPm/JvuGvx1r3OvCVCLqSN62Z145OxKPT5qqtHtohZEqwjvTq62Es39 1miqjqRl54PVR9f+F61Km0pXmdUKNWVXzaX3m9+SnMeW9Gq2dGab9lf7X7SdlLar91mvQ+/X2RWVvEVv u931te+amdmOlRea2UaSSPu46tun34OiPvX+u98x9fc7r/vwzMelc/D1vGWJJv2c9Dp+4qqXTW0n/Z6k 38OqMxK1n1Xfbyn6Hk64S2/Z5A9JAEBg88YAat0zUHTE6+r669MNz6/WlasPp/292McA1OJoFDc9n60W 58mk5ah8111/vtwr4OTerlqsky3vwtt0XQSNFTUdM+rre57xczw264ckACCwcyo85lNea90xCMAo6Cze 9V4PTf4jCQAIbHOFxzS6ZyCAUXjO6/qsfyQBAIFVGQPY4/Wg1x1D7zSA2mb+XycBAIFVSQDyXI3HAhiH Z7xunfWPJAAgsCpnAaTVPQMBDOL4vH8kAQCB1UkAre4ZCGAQ3533jyQAILA6CSDLPQMB9Oqhef9IAgAC q5MAVr0u1D0DgaCe8ro270EkACCwOglAdxTJs5wqgC79wOvavAeRAIDA6lwLIEe8jvqOQUBwz3p9sddT sx5EAgACqzMGIAtxz0AgON2o4NS8B5EAgMCaJIBVr6O8ZyAAMzM7WuVBJAAgsCYJ4LDX84beeQDtkACA wJokAPX9dbO6ZjeaB9ClQ1UeRAIAAmuSAES3ReWOQcB4aAbgepUHkwCAwNokAN2Y/fVeGQsAhqf7AKxW eTAJAAisTQJY9aojDgkAGJ7+T69VeTAJAAisyXoAKe4ZCIxPpf/bJAAgsDZjAMI9A4Hx+FadB5MAgMBy HADu8z8AhrduFWcBmpEAgNByjAF8yeu7vHLPQGA4X6jzYBIAEFiOBLDqlXsGAsP7Tp0HkwCAwHIkAO4Z CAxv3evhOr9EAgACy5EA5LhX7hgE9EdX4z6Y1EpIAEBgORMA9wwE+vOE17/y+pdNNkICAALLmQBWvXLP QKA7avn/yOutbTZGAgACy7EikKjF/2+vrBEI5PO41xu93p5joyQAILCcCUD+wuvve2WGINCcWv5f8/pI 0w3NQgIAAusiAcj1Xm/xev7QLxZYIGte93nN2vILCQAIrMsEIK/zer/XnV5fMPSLB0ZI19Rc6fVU0w1V QQIAAusjAYjmCRzwutcrYwOI7Htev+21l5ZfSABAYH0mgNRNXt/vlZmDiORpr5/wum+InSABAIENmQBk j9d7vW7ySiLAMtIKPg943TfkzpAAgMDGkABkt1fNF1jxet7QOwZkkGUFn9xIAEBgY0oAovkCN3vd75WZ g1hEWVfwyY0EAAQ2xgSQ0lWFtw29I0ANnazgkxsJAAhsERKApFcVXuiVFYcwJp2u4JMbCQAIbJESgOgs wX1ef8orVxViSP/p9c1eR93yCwkACGwRE0BK8wXe7ZUxAfSp1xV8ciMBAIEtQwKQa71+xOvWoXcIS22h W34hAQCBLVMCEM0XuMPrileuKkQb6Qo+mqG6kC2/kACAwJYxAUh6VeGveyUJoI5RrN3XFRIAENgyJ4DU 73nVSiysOYh5dB3/B73e2HRDY0YCAAKLlABEqxDf41UrDTGDEGYjX8EnNxIAEFjEBCA6S/CwV61KzFWF MZ3w+gGvS93yCwkACCxyAkhxVWFMC7WCT24kACAwEsDzaY73LV4ZE1hOC7mCT24kACAwEkCxdBXinV65 Q9FiW4rr+HMhAQCBkQDKab7AAa97vTI2sFho+WcgAQCBkQDqu8nr+71yVeE4LeUKPrmRAIDASADN6arC e71u8koiGNZSr+CTGwkACIwE0J6uItR8gRWvrD3YrxAr+ORGAgACIwHkk65CvN9rtJmDGmV/rubv6bt4 Qc3fk/d4DXEdfy4kACAwEkB3dN75Nq/rDbejGYd1zy484/V4zd+TQw1/b7Xh69XjQ16VNxQSABAYCaB7 Okuw0vD3V70ygw3ZkQCAwP4fH1uBmRNLNc4AAAAASUVORK5CYIIoAAAAgAAAAAABAAABACAAAAAAAAAA AQDDDgAAww4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAfAAAAPwAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAA8AAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXwAAAP8AAADvAAAA7wAA AO8AAADvAAAA7wAAAO8AAADvAAAA+AAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAPYAAADOAAAAzgAA AM4AAADOAAAAzgAAAM4AAADOAAAAfwAAAH8AAAB/AAAAfwAAAH8AAAB/AAAAfwAAAE8AAAA/AAAAPwAA AD8AAAA/AAAAPwAAAD8AAAAvAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAADwAAAKQAAAD6AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAA AP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAA AP8AAAD/AAAA/wAAAP8AAAD/AAAA8AAAAO8AAADv

Extracted

Family

xworm

Attributes
  • install_file

    USB.exe

  • pastebin_url

    https://pastebin.com/raw/H3wFXmEi

Extracted

Path

C:\Users\Default\read_it.txt

Ransom Note
Don't worry, you can return all your files! All your files like documents, photos, databases and other important are encrypted What guarantees do we give to you? You can send 3 of your encrypted files and we decrypt it for free. You must follow these steps To decrypt your files : 1) Write on our e-mail :[email protected] ( In case of no answer in 24 hours check your spam folder or write us to this e-mail: [email protected]) 2) Obtain Bitcoin (You have to pay for decryption in Bitcoins. After payment we will send you the tool that will decrypt all your files.)

Targets

    • Target

      https://gofile.io/d/scrqUr

    • Chaos

      Ransomware family first seen in June 2021.

    • Chaos Ransomware

    • Chaos family

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Xworm family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Uses the VBS compiler for execution

    • Adds Run key to start application

    • Drops desktop.ini file(s)

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks