Resubmissions

14/03/2025, 12:46

250314-pz49aatrv9 10

14/03/2025, 12:43

250314-pydpya1vbs 10

14/03/2025, 12:42

250314-pxnths1tf1 10

14/03/2025, 07:46

250314-jmdmxawvhv 10

General

  • Target

    2025-03-14_b66ef055f69d2d1a1d8a6f7128cc34a4_revil

  • Size

    92KB

  • Sample

    250314-jmdmxawvhv

  • MD5

    b66ef055f69d2d1a1d8a6f7128cc34a4

  • SHA1

    b0bdbebb93abe1c437d9b8f243368ca0de74603a

  • SHA256

    c7d0fa4e911df7241f9385a109ad4814d10fb640bb8151e7d1abeec1065bcacd

  • SHA512

    c052dd76b90cad8b5d40409d00ef41d3e75439edab7e6cb79d60ec98bd17af172e4e56fa031bf1cd5256d7baa0f6ea13648044da641df90e992f36432fe0d64a

  • SSDEEP

    1536:Y73nkB0DyMgQSm9NwcKzwpR+7JICS4ABwZ/gsZujGC:c/hKzstg5gs2

Malware Config

Extracted

Path

C:\Users\w57vivpvb-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats Happen? [-] All your data were stolen. Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension w57vivpvb. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [-] What guarantees? [-] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] Using a TOR browser! 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CDB85F8BF688EDBF Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: Jsa69R6+nxtE79MyxapZMT+ufLUV6XxZCy4br+VfSMoZI9y5rv/u9wn/A26e6Vz0 cbmTSoPa6v4FKbDEatalg9aHDP80CYf7uJZgaNHcSV9iNinRcfio+CS0/SjPp5Ma Kpr8HfDcqwIwj2GiPCFWL6mRtr41q6TAlZ5OvuN8u79r9IZ9jpAd1xTYV1MA/hAR g0l0geBcA6IVz3ar5x9mo1N/kzom+16+BT0BjbNqvQsrLm1CL/L+80yrL8mz2pbp E86QwJlqD05wfFdkRRoeAC8rdL/PNBXCQ3ykkLEljS6rRlMTZbEaZZwJfN7erlYa iOazSrRtrpPIkILdyCtfjd/wRS7af73A3q4IO0a1W9JRNvwBT1xrDPTWNrhlu6u/ C2TqsjPVJwRu78Wg6qpvj92dqftDXYHmNe+QzB3bFWz2EG+Xja/69v69+VwrWSI3 wX2V/XNvgX2c/eW2ZqCUryT5bUqjuZE7fZ3JSb/LK8PwJJP9l+djoaThVvzDQHGD R5sRoGdAp+2JKPtyfebVIBM7W1qxQILjDrluVXEu0N2JVSKswHl9f9btl3SiBVdj UPEuAivSZf3VGvAMf6q2nShIsJRYBNzRX9VraUQR5SmdWpL1dUQGii9TmctQ3HIa Pk1HNiWSt8/XC8d0hpLgx+lOqPO9w3eoYvRQcGtBtn8E3eW34esZlzjfmcTZvOEb omgyCWxlP441MjvNXkBwWpCi97dEn3kTctOb5IPyCVTWVTYSYcepTyPFXbvH3wiF //A1XeVVoVrZG50CbmN6DAt8rBYpxfsSIwjTItkNqAyUXw6P7lohA0tRIdy7yKza C6GutwdKDIAWdf7zwH9IjGfOYAhJPM4pKMvV5zN3AFEhToow+uQKOUXGDvler82i NV/+1cYpxAbImVukYkFWTt6r25WbR1u/1WDhFyebgi/Uo8JvxElX6Jmfx8aVWgSN 492Gq5nu6qyeglPDYo7jGI0X0zqgLiHVjVXJA8IR3E+OKNx/Sa0o6lX2QbXYYqtU zIkOyFZcQ4oQDXxFXpxl4XRRTRo/KD473jIdVYX1Une49+xZxPB25dg/ifqAHzWG TLmlEA/+NtuC7Aze+fEBnGymkRN2PhTXeqb8kedQw0BMOUQ4rIyMB+6wfnPNEGcS brTOY166lPIgucBl5ULZ5izcT63s+7ap9UJkXo2GAUTcBbCdREBxtxuc7xmeQpD/ 6z1+Yl9SxXX+5uUddzF08L1OuPTtY26ATIzdCLjaeneAu00UpvHPpl6qtmETz/QV MNR2bHw4KqZj+wyBWcs7LF2w77XVXQiYPRj7LXfuM1rMqARY6dlK8vBmfnEMe80p EFNHdCjh3njCjaaFX2WZ/q36ERisQzbJAFqzMQ== ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CDB85F8BF688EDBF

Extracted

Path

C:\Program Files (x86)\vpk2054fa-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats Happen? [-] All your data were stolen. Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension vpk2054fa. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [-] What guarantees? [-] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] Using a TOR browser! 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/57A7CD721AC3E501 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: DPFax+eluAf2F+Ksl6sYpWVOKoVJi21PeTKizQuY1n4ssfVswBbkiXVsVuKQNeCx KU4TlGGGLsNCMiY/IOxwTQ7NkYPlIVglIdWz7W6Rik7B/znWExvB/XFIWHn2Rnd3 bGqullP1wkTMi/YMAnZRulfvO4G0yDaSejWloKOBfE9Poj3QGtbyIhfCDcTlt332 q46Q8HAxKroohm3IZgCEQsP+gTd72a//RrPhaXozqNTkK/I/Cw023Ui7gPM0JOpU LsVOFBDDGx/A3n94Ku+SN6FQuygzNvIHpmDlhxri6xsOP+xAfDa15ca9bSYaIlda Grk4t9bIRdua4pGO70DICr/Uw2QlYIGdIwJeF1hPCST2A+j9a5jOEsdIlcQwyBpm ivqpa6kZn4HZ73Z9HkuH8dtpQLFTBgtgtWQ6GvQrTKcOkk1vC/Krb38OfybMZPJh JCDg/JZLPKqaELHvNVU2Bwyq4Z6FlfqBcl8wO38v9KC0132e63xbgbXulAm/EkqP GYYHRPJgOBJ3EiOgy94EoYAVf+L2mrvVLxWqS1L9FqOoxaVSPSNEH3bZVatxLzFj +NtCOv4JsE37KxjH8HhKDH63LeaRkFF23L2LReG9ZCohRSZS97rGVVBEwLXoyfys EiZBLu0xpFSttp7Dwwc+TvXbSOOXqIK/1i0xlU60MTvXmm6rw3LW4qdchrBgtbuA oydSn3e/cPntntgOt4cQ9q4cT/6coDOlu9VxWXifKeoBxTmH5A9KQuDDb8iIWAxz Kad952kxHsg6Db1p5e6JrEbPKE/dAYrOFlRRvuadKfTo2lDESFNFhYd54EwhCPll vVVKzREtOZfosCynsO3TfNAoG/qO8JpGzE7ZQGRAeC3jn3pKHnVOno15/7fxa6m4 Lo7aTbp19+pMxWiwTGooCUfyxwDZFDZoH3jsDVqUxuYEfPey3WwowcZF0yWRv0bV xZAMNxcJmSQJbsAWarDQdpR4DxTxiJRpTCmfn6cblTMCEmfVspx/B4dLeEDAOwdU Jrxm+0TLAWU6uN1ZmNed076Hm2+KZyIijAG+f1n9w1ERWnfD4Xpv0hiDaYxvQOZq 3z2YDIJKIAr29Czklir+Z5P2gqpU79vVgCqsD2bD3vTEdp3GCjCgJOP7BC4h1E0J 6zG/QLxKMv6bJOoZccIG5XdOLRST2NUUyEHauAS59FVNVencWtLe3mJGPju6WHdW jqqqtGaVVcFC3Etn3C51mlwsTG6oMtYuAJ57VDZgDKnJBLC6ntCIWanxbYd0v4d6 PwHsnf2qy/4Vr6kHvd3BlB0zxeCASnsXAYFNGs8F/rOUeyzUGfZe/OnXQq+D2Z9A HYwxIiLV141Hrz6OPRQRYmqJE6gu2MIJ93DHNnzK4gs5DA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/57A7CD721AC3E501

Targets

    • Target

      2025-03-14_b66ef055f69d2d1a1d8a6f7128cc34a4_revil

    • Size

      92KB

    • MD5

      b66ef055f69d2d1a1d8a6f7128cc34a4

    • SHA1

      b0bdbebb93abe1c437d9b8f243368ca0de74603a

    • SHA256

      c7d0fa4e911df7241f9385a109ad4814d10fb640bb8151e7d1abeec1065bcacd

    • SHA512

      c052dd76b90cad8b5d40409d00ef41d3e75439edab7e6cb79d60ec98bd17af172e4e56fa031bf1cd5256d7baa0f6ea13648044da641df90e992f36432fe0d64a

    • SSDEEP

      1536:Y73nkB0DyMgQSm9NwcKzwpR+7JICS4ABwZ/gsZujGC:c/hKzstg5gs2

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks