Resubmissions

14/03/2025, 12:46

250314-pz49aatrv9 10

14/03/2025, 12:43

250314-pydpya1vbs 10

14/03/2025, 12:42

250314-pxnths1tf1 10

14/03/2025, 07:46

250314-jmdmxawvhv 10

General

  • Target

    2025-03-14_b66ef055f69d2d1a1d8a6f7128cc34a4_revil

  • Size

    92KB

  • Sample

    250314-pxnths1tf1

  • MD5

    b66ef055f69d2d1a1d8a6f7128cc34a4

  • SHA1

    b0bdbebb93abe1c437d9b8f243368ca0de74603a

  • SHA256

    c7d0fa4e911df7241f9385a109ad4814d10fb640bb8151e7d1abeec1065bcacd

  • SHA512

    c052dd76b90cad8b5d40409d00ef41d3e75439edab7e6cb79d60ec98bd17af172e4e56fa031bf1cd5256d7baa0f6ea13648044da641df90e992f36432fe0d64a

  • SSDEEP

    1536:Y73nkB0DyMgQSm9NwcKzwpR+7JICS4ABwZ/gsZujGC:c/hKzstg5gs2

Malware Config

Extracted

Path

C:\Program Files (x86)\232ro7yse-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats Happen? [-] All your data were stolen. Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 232ro7yse. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [-] What guarantees? [-] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] Using a TOR browser! 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D89057C0D7004E62 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: 2Dgbs9wl26yLUDUAvHLWkNEumbFuNWEOzxe3kbzZTy03256go77JB5ESEztjxV9g tm5/vVr61iEnT4Hv7KovMwFNLxTV2RoJMILM4CZLIEa7ZgUOudAbI7y4l5GPSzRn c3oT5C2cDQNdoKrJgtTpPykbFoxhEw2c/ZasBtLIDTr7S4MkkDa7Km0dSvzrrxnY /21M9FbgJ3iweHPOCmgmFTFuVlgAklJWY7YLV0+k1AMdmSs1AUK3J8xikxCIPagN dba5lk7ngium7lHPa0yp77/fYaL3R/ZCKXKvNRaD+64mJruR+rUFoHMin+NCn2vQ N1bbOCM1nER3JM9BlcWFvcnFMf+rL14xGU7fXUc3XpXwwYse3DPNRrfbUks8ALcE 1+ZgDj/AJfAqhyjQwISC2poZ3gWID+qHDRtRp+mJ78iTHCOE7sTLyB2wl6vHVjsu 6JqBYR0beY69fjJI4dTN0amF+XzQAtzMY+HLhqe/pdwOe4pR/O+xWcWxsJEd0baF ENr+TBVP0e6SlHor5PS5AMrjT4ua6J3kE3RtlnIY2cKz7bATytm6Q6mVVphhcXAj z3INF3g/G0EOSAQju2qlPzLw51kcd/iS+7N3J3vbvsf/JdguNTgvUaW4OoZrCFEc AEYGKn7/8n1TGSR2IS+lp3fILfzdMzGibe40OXf3N3XnJ+dDfXH5eYgtinUy3fgk 1ebaio2aEpxLFpOUX2NB8Ps2RA41RbjW62xuii0ZqATk8glsppwehRL+WA6SlpYc oGVzpcu0RQC3+eaPHNvCE/YB88ZIQSyMdrth5iAFbb6JPFXDRVwCx7qT1UFprCxS JbGfFdfN9wFwaGVNW/ZbppjAzNQ4UWAEuHvNT56TN8EFicRstSIM25frAJNO1rzC tEDRsCBNm0WjTJFI4PNQdX+mN8xgw3l8eRNf4MIMc0/KCQ8UAOA2T4WLOA/AWUYu tdYeb717Kzh41WHtSWphcHKaAC0aU+GEubeQ4jENIHv3XNg8NyGj1LQWwt/3W3uC qNaHWeuHfRADdvX5SBRFdlYcXSWwsgcybGGtLO/fiO5ge8m2YHI3et1+LrA8NcGl xIW2mmpTwmHos7+uT6IrUtITpmB78pH8I8KnUUGoWGwaweVZu0YRMvy5lsNhL8L+ s04iB48mRGiQvAnxkVxR/z3suO/dHMtOdFjC8xvCcyRe190NyQLRTsTuIY9uWDPR bDOlMQIvINSjICdEIGJHqU3L15VpMHgiAzIfNKLMwHcj4+7orD5KEtZ43FUmwqVH ePkyNZDgOCB9gstKoktvyGtgVdd1qlfNn/XTkn3sPn+ThzadrHr0TYG/P/Ujklal jGBMnpQC6waHlMetRVJjcDYh7cUa3pm1SGWEn+DE0QRX0g== ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/D89057C0D7004E62

Targets

    • Target

      2025-03-14_b66ef055f69d2d1a1d8a6f7128cc34a4_revil

    • Size

      92KB

    • MD5

      b66ef055f69d2d1a1d8a6f7128cc34a4

    • SHA1

      b0bdbebb93abe1c437d9b8f243368ca0de74603a

    • SHA256

      c7d0fa4e911df7241f9385a109ad4814d10fb640bb8151e7d1abeec1065bcacd

    • SHA512

      c052dd76b90cad8b5d40409d00ef41d3e75439edab7e6cb79d60ec98bd17af172e4e56fa031bf1cd5256d7baa0f6ea13648044da641df90e992f36432fe0d64a

    • SSDEEP

      1536:Y73nkB0DyMgQSm9NwcKzwpR+7JICS4ABwZ/gsZujGC:c/hKzstg5gs2

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks