General

  • Target

    21833028067.zip

  • Size

    100KB

  • Sample

    250326-gnsgcax1hx

  • MD5

    5ef04d944799322d4e0d62ea214c64b3

  • SHA1

    a20436042447f5217f61e3e35b6a17ddf22be7ed

  • SHA256

    090580569f47c90376e9cdfae15b493939241c57600727b57fdf56a8606d06c5

  • SHA512

    d7c438d45e8c3887974630ac4ba91132de70910f50d186e49fa5167559c850aae8f36a3f3947557d486e7b6df84b22c4d87a9533d17306a0cc4459b9884ad94f

  • SSDEEP

    1536:4AQgl0G2kTm1yg+od/TyTLDs2TszekgdOWUlQC0+cNiMC6BoPFxw+mI:4Ktxy/TyTns2QzelgfaSJMC6Bod++mI

Malware Config

Extracted

Path

C:\u3faqlCea.README.txt

Ransom Note
~~~ To Dear Rota Trasporti Team ~~~ >>>> Your data are stolen and encrypted We encrypted and stole your documents, emails, and databases. We have viewed your email data in MailStore and can find all your customer information and customer needs. And we found some companies in Italy that do the same business as yours, including but not limited to the following companies: 1. https://www.girteka.eu 2. https://www.teleroute.com 3. https://www.nieddu.it 4. https://www.robustellitrasporti.it 5. https://www.matricardispa.com 6. https://www.monguzzitrasporti.it 7. https://logisica.com 8. https://itlmgroup.com 9. https://www.sogedim.it 10. https://www.dgftrans.it If you do not contact us and accept the negotiation, we will sending download links of your data to both your customers and competitors for free. And will report the information of users you do not care about at https://www.garanteprivacy.it. >>>> What are the benefits of working with us? Network security is important, and you can consider this experience as a paid security test, we will help you point out your network security risks. Our ransom is much lower than other ransomware, it is even lower than the price you pay for a security company to do security testing. This amount of money is nothing compared to the fines of privacy protection laws and customer trust. >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> You need to contact us with your personal DECRYPTION ID: 055CF6F4EC4B6BE3C224B07653F800FD >>>> To contact us: Way1: Use signal (suggestion) 1. Download Getsesion https://signal.org/download/ 2. Add friend username: aleen.29 Way2: Use session (suggestion) 1. Download Getsesion https://getsession.org/download 2. Add friend my id: 0549caf3190e21ab3fca15d5327aff676e9457fb96106964ecd394b69674abe301 Way3: Use email Email address [email protected] To ensure contact, it is best send message use three ways at the same time >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!
URLs

https://www.girteka.eu

https://www.teleroute.com

https://www.nieddu.it

https://www.robustellitrasporti.it

https://www.matricardispa.com

https://www.monguzzitrasporti.it

https://logisica.com

https://itlmgroup.com

https://www.sogedim.it

https://www.dgftrans.it

https://www.garanteprivacy.it

https://signal.org/download/

https://getsession.org/download

Extracted

Path

C:\Users\u3faqlCea.README.txt

Ransom Note
~~~ To Dear Rota Trasporti Team ~~~ >>>> Your data are stolen and encrypted We encrypted and stole your documents, emails, and databases. We have viewed your email data in MailStore and can find all your customer information and customer needs. And we found some companies in Italy that do the same business as yours, including but not limited to the following companies: 1. https://www.girteka.eu 2. https://www.teleroute.com 3. https://www.nieddu.it 4. https://www.robustellitrasporti.it 5. https://www.matricardispa.com 6. https://www.monguzzitrasporti.it 7. https://logisica.com 8. https://itlmgroup.com 9. https://www.sogedim.it 10. https://www.dgftrans.it If you do not contact us and accept the negotiation, we will sending download links of your data to both your customers and competitors for free. And will report the information of users you do not care about at https://www.garanteprivacy.it. >>>> What are the benefits of working with us? Network security is important, and you can consider this experience as a paid security test, we will help you point out your network security risks. Our ransom is much lower than other ransomware, it is even lower than the price you pay for a security company to do security testing. This amount of money is nothing compared to the fines of privacy protection laws and customer trust. >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. Life is too short to be sad. Be not sad, money, it is only paper. If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future. Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment. >>>> You need to contact us with your personal DECRYPTION ID: 055CF6F4EC4B6BE3ABEE0872AE2638AE >>>> To contact us: Way1: Use signal (suggestion) 1. Download Getsesion https://signal.org/download/ 2. Add friend username: aleen.29 Way2: Use session (suggestion) 1. Download Getsesion https://getsession.org/download 2. Add friend my id: 0549caf3190e21ab3fca15d5327aff676e9457fb96106964ecd394b69674abe301 Way3: Use email Email address [email protected] To ensure contact, it is best send message use three ways at the same time >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!
URLs

https://www.girteka.eu

https://www.teleroute.com

https://www.nieddu.it

https://www.robustellitrasporti.it

https://www.matricardispa.com

https://www.monguzzitrasporti.it

https://logisica.com

https://itlmgroup.com

https://www.sogedim.it

https://www.dgftrans.it

https://www.garanteprivacy.it

https://signal.org/download/

https://getsession.org/download

Targets

    • Target

      a756abab3a42def4b44a7ca678fc445ae4ce627bb3e38e2b804de6e4e8fa45b2

    • Size

      149KB

    • MD5

      7f040e7be2a5085703fe895d0625c925

    • SHA1

      0be799d98e6719bfe594fb502e012e173bc0bfea

    • SHA256

      a756abab3a42def4b44a7ca678fc445ae4ce627bb3e38e2b804de6e4e8fa45b2

    • SHA512

      746b5b8b1c62e8e500e5d91fabb8c7a9ddae5a47440eb04babfc8a7a39dca89f51c2d846b5bc1993217c1dc7f8f6f9b2aa29b42b6a59c3fa5357cf48f020cfd1

    • SSDEEP

      3072:+6glyuxE4GsUPnliByocWep9/PCTgLbvI1:+6gDBGpvEByocWebPAgLDI1

    • Renames multiple (7707) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

    • Sets desktop wallpaper using registry

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks