General

  • Target

    b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe

  • Size

    719KB

  • Sample

    250223-p1bclaxlby

  • MD5

    8474039d83805eb7b447325c3a8d1ebb

  • SHA1

    a07d537f4253745a087709a9a07c449f84deed8d

  • SHA256

    b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649

  • SHA512

    3272091bbf123ba5e1592e8b2bd7740cddcb174fa158bc6980b25ee61d92387e94a25284736253f83a6eea78b427f6717e888e843db9d7759cfe9a7676576438

  • SSDEEP

    12288:q4UOTYQivI2qZ7aSgLwkFVpzUvest4ZEbjJLuhJVoM7SPd:bRTYVQ2qZ7aSgLwuVfstRJL6YM6

Malware Config

Extracted

Path

\Device\HarddiskVolume1\Boot\Recovery_Instructions.html

Ransom Note
<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">820F5956416ACB3A00E6A64C62632EC546B12D4C47B64B112273DD1C6CCCABBCB0086E447B110EB7F392DDA0D57399D194CFAE23E42D71EDE440F97BB48113DD<br>0B9C9FE9D251ED84DFE1E83A9DD0BA5B4C93D9A577C7F76E2A5C201164C1C397A865C6D6615C36623960EE4C3729CA1376C80DCF62978C8EDEEA2E63E2CC<br>397FBBC6F56379019D917C1E13E23A8ABEFF6056D86267249608BE0297E0C15A7FEDEB8C6E89FD40EED811BDE23CEDBCE5C55B21BE2344D70545DF9BD437<br>3B69E55D94C9F29A7E2BF6269B6F5E92D2DFC91CA53F6F8DBB80F23EE52EDA755F855C1E9D1C93B5DBBFFB1F62E8A3C745982B32B577829DE08B6D75F230<br>5B2F82A4166C686CCC3B26757016CB320605D42D44707A7DAE364A85C42834303F35A999B6C6717253F4660ABD24E9EA79CA9ECFC66882867DDD29284A5B<br>6BCAFB0CEC5AC9F3C001C0E7B498F46D1134C96D83402C7B95F4D27D49481D3C589B596BEE144F7352BF989D511E1A8C76A0E857188C41EF9553BEC063DF<br>8F116E58E07037C46ACFD5E98F135B8AFFA7979248A0D7F270FCBD138C176320DC0FBA9A515BC455911D7DE5C207B7D3486ACEB00F8E0109591817B7B7AC<br>346FE88519A4BBD87E36D10FF7C19057CFFF8306C4443568DF59D06360923C9097AEA3C9680B062DC7C31052F72DF320EC00F8CFCCE26A8B8ECDAC687A00<br>DC78454931D481BF5874C7147972</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>http://gvlay6u4g53rxdi5.onion/31-LPy3hdSfGLBgLSfGcKN9rubDKoa1VMK4-FE2QhJxMA9mVtJhLa68EmZHP0auHxLiA</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br> 4. Start a chat and follow the further instructions. <br><br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected]">[email protected]</a> <br><a href="[email protected]">[email protected]</a> <br> <b>* To contact us, create a new mail on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr> <b>Make contact as soon as possible. Your private key (decryption key) <br> is only stored temporarily.<br><br> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Extracted

Path

C:\Recovery\WindowsRE\Recovery_Instructions.html

Ransom Note
<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">B83EA5606CCAE2F37D093E92EE8E6DEA331D3264833A7C1B80F75BE9219F5A6702348C31ED2C22716021CF9DECA5142F9A4349584316D46849F867D2DBCCF701<br>63166E980E1154A82EB0E62FC9B6ABD4883488DBCC567CB2689BE00BBF584AC1F1D8EC03BC29A0C45D4310DC1B0C4ADE3B195055114D8F0F7F588B477B88<br>1CAA62D342B07C436DC23D698A3C78F1DC232854B3558D3B12526C1B30C7250E9E4780C6ED9789D74AFF56BE7CE9AD943582BA0ADCFB05914477CE18EEBC<br>8D8510BFC070F670961927A2ADB44463C57A01B090F851EC8952C1CB736B82E9B3A951576971551D3BF98C782A0BE289AFA7E1DBCB2C566A0F7AD7B207A9<br>45DB19D4D4B8EB68E8E6A20855E7D79B17603C7696C3418C0DA94DAF9B174CF8CCDEC852BE209BF8EF0C05A3DF234690C5803CC80972CD67F70031C3BEB7<br>A43D33135164D17CA33D449B962ABFCF6ADAA0394CFBAEAFD1871CE458FF66B648A95BC1A149AD939C6FA8A4614593BFCA9E030F73740B2F4EC9528F245E<br>99E97DE170FABC184E74C7634691CF4FBE2952F10AD440724F3AD60A96C845FE100BA5DDCC7CB86D7455E0A571CA7D737B931CBACDA61BAF545E9F986326<br>1662C7C4A37367B539EEB8E9BF82E859B97896AD3844189D47EC623A625868D977573956811E5C068C697FB9AF1A0DCCF5E4EF447E6BDA1A6BF90B3BEB0A<br>5138327EDAFFC897E04D7EAFA0BA</span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <a>http://gvlay6u4g53rxdi5.onion/31-LPy3hdSfGLBgLSfGcKN9rubDKoa1VMK4-5noLcNtKUK4LTjd02I6dYO2c0tJMg981</a><br> * Note that this server is available via Tor browser only<br><br> Follow the instructions to open the link:<br> 1. Type the addres "https://www.torproject.org" in your Internet browser. It opens the Tor site.<br> 2. Press "Download Tor", then press "Download Tor Browser Bundle", install and run it.<br> 3. Now you have Tor browser. In the Tor Browser open "{{URL}}". <br> 4. Start a chat and follow the further instructions. <br><br> <hr> <b>If you can not use the above link, use the email:</b><br> <a href="[email protected]">[email protected]</a> <br><a href="[email protected]">[email protected]</a> <br> <b>* To contact us, create a new mail on the site:</b> <a href="https://protonmail.com">protonmail.com<br> <hr> <b>Make contact as soon as possible. Your private key (decryption key) <br> is only stored temporarily.<br><br> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> </div> </div> </div> <!--tab--> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>

Targets

    • Target

      b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649.exe

    • Size

      719KB

    • MD5

      8474039d83805eb7b447325c3a8d1ebb

    • SHA1

      a07d537f4253745a087709a9a07c449f84deed8d

    • SHA256

      b2493a580153291b69ca23190d00a00b1220cd0aadf469b3974fdaa726516649

    • SHA512

      3272091bbf123ba5e1592e8b2bd7740cddcb174fa158bc6980b25ee61d92387e94a25284736253f83a6eea78b427f6717e888e843db9d7759cfe9a7676576438

    • SSDEEP

      12288:q4UOTYQivI2qZ7aSgLwkFVpzUvest4ZEbjJLuhJVoM7SPd:bRTYVQ2qZ7aSgLwuVfstRJL6YM6

    • Detect Neshta payload

    • MedusaLocker

      Ransomware with several variants first seen in September 2019.

    • MedusaLocker payload

    • Medusalocker family

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Neshta family

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Renames multiple (216) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks whether UAC is enabled

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks