General

  • Target

    2025-03-14_b66ef055f69d2d1a1d8a6f7128cc34a4_revil

  • Size

    92KB

  • Sample

    250314-kdveqsw1ex

  • MD5

    b66ef055f69d2d1a1d8a6f7128cc34a4

  • SHA1

    b0bdbebb93abe1c437d9b8f243368ca0de74603a

  • SHA256

    c7d0fa4e911df7241f9385a109ad4814d10fb640bb8151e7d1abeec1065bcacd

  • SHA512

    c052dd76b90cad8b5d40409d00ef41d3e75439edab7e6cb79d60ec98bd17af172e4e56fa031bf1cd5256d7baa0f6ea13648044da641df90e992f36432fe0d64a

  • SSDEEP

    1536:Y73nkB0DyMgQSm9NwcKzwpR+7JICS4ABwZ/gsZujGC:c/hKzstg5gs2

Malware Config

Extracted

Path

C:\Users\78i5hyf-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats Happen? [-] All your data were stolen. Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 78i5hyf. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [-] What guarantees? [-] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] Using a TOR browser! 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6168F3EEF9704B5F Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: wf8CMuaEUoN1xcRrhqE3Z8zddRjJIsTxGJ1IgdSJqvdoKbIEUpIIQjha86MqS8bc OgOdMasTKGgIPpxeLBXsPcY50bNpq4wrLIQXy5ph01Gqer36UhFurezo0w88wDy8 JaMrEPjQNwcxLqcRXUA4m0NeWod4U6WY9xcHAh2hQ1+xjkU1VIQ0odEJ0XJOfI9y bbkyAJFbKtE8rrme3KQoX2CT7xIkT7iaYMJOzAXw1D/C9KHEgIrTb2jAetYhZ3nV Pl/BMl7biTfaiKReR1ZVu3aiqyKt0mrpjreI7dVuQxQNArKlk7hf1fuGpTmWakMM nD7i/5BZNGag/k8mpB/w3fDlD3MEzrV8fkrhJEX4/VtyvUpQySrEstREoM6rjHf2 DmKOeGNNng38gCptHBeVvZFLLfzQW74drzqgstaWJAv0YNlLuSI7yw/vPhI+M360 0kaEwP0GlKKH6r1Co+OqGXEAaLQQNyOFFfMujyAxCvGmiT97KSGz8RW5AHQ3qCCZ Vmb7xDdVbhXXcdmlGVtIeBAcYL3xhKjdsN72l4Ym4VWrV9gcft6iAFfhmJzP4Ije bz7B9YXpQ0HqxsDm94NDrh7SggXsJB8gjqw1GV9ACYeGDz6iSp1hYW55Yc2h9qNa 7Aum6vBw4s6QPyQqsllXlL6rokIAkBmppwCiLnEzU/m3yARjtrrZlCKrrSrxJC6T SKVOh5w7evjufDg7s1B8wqj0v97Mwc7l92/yWq6pciq26TcrT2HEm0LES2/jg/U9 5NkVlrKeY4Az1orv26MC5oSPitoJu9KtTanaxznCW76N3zXLkn2uw7fu+/TmqUG5 tZIlYEOdiiQZAFVrbFuSN377/lGibz8Xcm1KZrXwRUGt71DlIYiCUAZRnIj7oX2S /Tvf/bclOHhzk+a8j4J72aYuBu1QsXNAn3kPVH0oQyKd3FCjyL5dhS4D8/FFgYfc zavr6DdI8UO30KpD3N51VCvx7KXN1YlQLZEe8x+fd8b9esgbDsZ7dRnYmyQoiFMS Qbi7I5di0Lt2km6gcy1sxc0oG6lBcosshyN/s1ltPQ35U9P+CWAb3WEDJ3VsnqlB BKZ5PIU+03VewyyVHeq0e+9femnxxLufxAsDtT1Dhx6QeQVVr+f4UlBvYowGvkhE 5Paa8BjMCqLFELcakOxZ9XcBz7uNJ1mIzRG3/rEtdxxII6YDAl+RNvmnovFUBH5l KCGZe33CAFk262hmv7fOK+5BlGKjE999huYMLKfQqKdFOONt7yN53tF7pIF1vZ7y yPxxnTi9Erl9qeNY8m5jao6WjJZo1qXN4CRRs0MC+sfNPmATLKKnYe7LFwDFb1Oq 16GRfNdiwr4TRfVKdT3bdfScz3nG0NuG ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/6168F3EEF9704B5F

Extracted

Path

C:\Program Files (x86)\g3676-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats Happen? [-] All your data were stolen. Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension g3676. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [-] What guarantees? [-] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] Using a TOR browser! 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/25A19BB6D3A8825B Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: gUR+z5gfUtYtnxOTNZ98PmNpZ1lUcA7h2q4AJDWqBiVZI8wn4POnpjKymWrrEUe+ X/Xv72omXfkxCa/e0SbEf5PxTP3Lhtnt/C+gi8UCN18MPujuEM0i0lGmgJ6ia4tu ETwXBAEeLGmt0LwLehJF9eK2Y67D7/1sGMsD37DM1ML6GchkqqAc3hfLdwLOva5L I9PT8XhP8xgMq8Y/+6sfVcVbSQ1VH3SAF/JZ1Z/NGHoiuGLxYx8fz/7ZYUvR9+MC 6nT5km9nQd2oMhBv3n4beDSmFWoA5IBNg0UGg+9io4tAdggMDwiAifqtkP0ocNUs PMCKevrQi8Ic/Diyr8WpnLK+sgA9tLCmvea2NYDSvK0DQjMyQhACr7n0Ya9/0zvA vRbECJYwR9VHTMvKai47B3B+hU1mPPYcXh6Q8AQFzgFEvtFIwksn3XCsVFV2oNhr 5VNFZMMcRoHpluwwBhq0YT3E4r5gdBB9KmKKjqPwDtaOj012sfLuCZxjRPrAHyqq QeI1itKDDVvwSoPDMQYxXTDNHnAqNWWcp1gIMQHx5ghshDPxIuNJZbBRAJeLUxUM dJFLFosnlzWF5szuCznI7Tss4qMB11tq3T/tC1tDk1t8ryCbZguA3/xr5Y9fBd78 qC6BbqVfiaNeBIncllxjxNGH/vP7lwHDPRlbeoZkZQP3l5P4KQwZOLJuwCEN08Ay NZVBQ6biboLLOOsTPPMOHHbZPmF5rmdBI0X0Y4luFIw3dlEsxirIlxnB7r+P1ETj YUOyCwxQO6Gjv+jCcMVtHNSf8dEQvz3/3hEIFuyS4AKAsE4hyBPvVVFYdYU9Mj/1 YQv9bAmPQT4L4loI55QT/jydh+D6a/n6jHsGQ7kxMOuqCemi5jIFOV7pVO6Kta/f ph+eGqOPHY9P168gZSw315Bis1GXDPF3D7ecYw4Ezyl4/94F281NzCZV2PycHhkV 3thWgdcfxLMMFaDjR+Q0Ihe8c8CMRIVk4KPhWGFT/uYQOVoRsuRJ6bw1wEWlAd9F dUhUWuRAONRh32FHIneWCpk2vA/fz82nAEMaecHmpsdLM1vRAhAoxo08MZDYnFhJ xaLAya0P4RvcoG9lxcTqVWlYAowhmdhtFiaKdXZA22QFyzElTWLz9cbmVhHaK7iN ieRGCubH/qZzYs5RCFxqWa+nDJDs6osLzx1b+qgqlZJ6CUGwdGxawEKDKf4X4SpW zI/4MEmE4I5ac0fzI4IgFC9u9RZWRLZVfUB8TtlQP01RfWk+CAquXKj4Yhl5Zbqh cXLuoppCTjg4k1swqll5Nl9ezYudhanSRXKqIu2FpQ8ZQvQzkpZ/JabVc8e9rjLA UTvriNk62WM6VTWyt3bMqbTOA9/fPjTCfng= ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/25A19BB6D3A8825B

Targets

    • Target

      2025-03-14_b66ef055f69d2d1a1d8a6f7128cc34a4_revil

    • Size

      92KB

    • MD5

      b66ef055f69d2d1a1d8a6f7128cc34a4

    • SHA1

      b0bdbebb93abe1c437d9b8f243368ca0de74603a

    • SHA256

      c7d0fa4e911df7241f9385a109ad4814d10fb640bb8151e7d1abeec1065bcacd

    • SHA512

      c052dd76b90cad8b5d40409d00ef41d3e75439edab7e6cb79d60ec98bd17af172e4e56fa031bf1cd5256d7baa0f6ea13648044da641df90e992f36432fe0d64a

    • SSDEEP

      1536:Y73nkB0DyMgQSm9NwcKzwpR+7JICS4ABwZ/gsZujGC:c/hKzstg5gs2

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.