Resubmissions

14/03/2025, 12:46

250314-pz49aatrv9 10

14/03/2025, 12:43

250314-pydpya1vbs 10

14/03/2025, 12:42

250314-pxnths1tf1 10

14/03/2025, 07:46

250314-jmdmxawvhv 10

General

  • Target

    2025-03-14_b66ef055f69d2d1a1d8a6f7128cc34a4_revil

  • Size

    92KB

  • Sample

    250314-pydpya1vbs

  • MD5

    b66ef055f69d2d1a1d8a6f7128cc34a4

  • SHA1

    b0bdbebb93abe1c437d9b8f243368ca0de74603a

  • SHA256

    c7d0fa4e911df7241f9385a109ad4814d10fb640bb8151e7d1abeec1065bcacd

  • SHA512

    c052dd76b90cad8b5d40409d00ef41d3e75439edab7e6cb79d60ec98bd17af172e4e56fa031bf1cd5256d7baa0f6ea13648044da641df90e992f36432fe0d64a

  • SSDEEP

    1536:Y73nkB0DyMgQSm9NwcKzwpR+7JICS4ABwZ/gsZujGC:c/hKzstg5gs2

Malware Config

Extracted

Path

C:\Program Files (x86)\g7nu864-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats Happen? [-] All your data were stolen. Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension g7nu864. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [-] What guarantees? [-] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] Using a TOR browser! 1) Download and install TOR browser from this site: https://torproject.org/ 2) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/979A3F5C8536E116 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: XnJzNSuffh+lWaNSfvWX63tmQh+vaq+BWL6z6UPOWcF4nJHv/4jbndbDOm2uO4uU i+HigYCDP3COmFSaY63zAbN+49zJRhPcbyeHntOylWAymHjfkjQDrCRn6ZHBULEf 8bD6WgVoKXwslty162mJUbXSazu5wJ3yDmRIIAPkaWuu9NnDdZ7/VYoO69mR3bho iQVbFleaNfNlMHlLalxppTWFmWHgo5GUbCpJBncPEXreWm3TQffpjD6fmtfOhVuL l9MOy4+pAOasRFykTKLxmiTI7VR2SIX2LbFHs0hj9NCXntnnoW6P6L/Eiv7DQb0X uXorB9hjViflEB+1i9QqKuSofmuXbyk7pneKmdTYcqUg04WhBAbWGnMtMgg/fR5s qvwBnqnUGVkUxZOIgBwjrpRHVEqQ2SqF3SVIuJFQb0nyn+cRmNv7bk0GuXbpN/Kn 7VbLMQEHykN/GN+XW01WnNuGOAragl7NK0CtKGuRr6w8ldhvVMKiqgckdalRy1CS Q4uILZOt5kM3wmZuO32msO5fz8OECg9mcys0Tqw6Shg0c+wdbuzNcfcYVnP9MpNt m9NRpr/zGWJdogdKgP98lVT6Eg37BwnGXW/Kn3wc3Lb/yFdkaGz8rGRhOu9TZa1F zZhn7xjT1L8pZa9oSfTvxkcAaqQ5pTg3qf+wSVzblgrAm1Q9YMwVlg7pHgg8X1jJ iETuxU+zEuIxV4W4oX/QyyxM9h1IHUEuoST6IAfAT/Epy12IZcyvQ+QD/iDGjYbC E9DGamli11ra/w19eGJhLe7bSdYb5/+XQGONW+sRPNKR66MswVAoTAnmmvUhc0b2 tOTCypXJoF7V+9cc3reSPwMuP5z+R5Y62QK+ZOwu4y7qPGL6NYtD2GEqft6b0dlC 8vTnZ3MPrVpUHYNW7fBo0YjUwb4kZBJqfCBZDdsEKl8mcgLNtyYftzen89hOKunF wKx0WXO79foSMDSbqqOoFtiomPPkzKuEN/J3YRc35+sAFMC/kgw8vcrk6xv3XPen CZ4AZ74Rr8uoE/5KLrcdvPMOFSnN/MTz1c7PpbIGjbX97cp+cZfvtIfO2zXKF8Ee l/qKBUH8V6d0Fmv1xbNuMbJ3dL8aY/Hsn05rhxSjq4sEsIaRFoGzLhS3xv6LvpEv APxn+kQv90OuDDw/zWbcBDYsTnhzs7aoxlEBJvA+D7I+LmdxE2+69peaVcWXas7D ruarNcJxzKjRXQyEThYsOeOXtl46Wqpa6x4AzlqY1Jk5FZi456OGCKcX0LqYs+Ae zIZfOamGEeIi9A61O9EPCqbsPy8aPdonAXC8WCsbBSE1besyMtDuDXQVbOaPa1WC fnEmRIoNfXu/PaNTXEEppLx3sOdNDGUQ70MLG61+ ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/979A3F5C8536E116

Targets

    • Target

      2025-03-14_b66ef055f69d2d1a1d8a6f7128cc34a4_revil

    • Size

      92KB

    • MD5

      b66ef055f69d2d1a1d8a6f7128cc34a4

    • SHA1

      b0bdbebb93abe1c437d9b8f243368ca0de74603a

    • SHA256

      c7d0fa4e911df7241f9385a109ad4814d10fb640bb8151e7d1abeec1065bcacd

    • SHA512

      c052dd76b90cad8b5d40409d00ef41d3e75439edab7e6cb79d60ec98bd17af172e4e56fa031bf1cd5256d7baa0f6ea13648044da641df90e992f36432fe0d64a

    • SSDEEP

      1536:Y73nkB0DyMgQSm9NwcKzwpR+7JICS4ABwZ/gsZujGC:c/hKzstg5gs2

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks