General

  • Target

    revil-fixed.exe

  • Size

    126KB

  • Sample

    250328-16vtzasvgt

  • MD5

    329b8aaea517a511908683b56446db99

  • SHA1

    9abe20a9c460a3e530cb96658541c6d25700a529

  • SHA256

    c09c691d40d8b935de4b60c92e1d4fc85f409fb546fd4a5e5b5483ae150fbf20

  • SHA512

    172d290abe8fef35e8bea43319dc68092c61389257c73e94fcde68f67f97022c1bbda1fe50cd35775bda6e2473af1bad0e5cdb2ff7060e8365bbbe4765a3b3fa

  • SSDEEP

    1536:oxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6QdZls8XzUXiWr4X5Fg:oMhQNDEtb3A2ZHjUyWr4X5FTDUA

Malware Config

Extracted

Path

C:\Program Files (x86)\yfq6y-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension yfq6y. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/08DCD1C616F5D272 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/08DCD1C616F5D272 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: XHIfzOFv1XEpO6GC93V7j6TtGagRIQNEdNBBb3lblSQ8R0V2sT7qxJMMto1aBwTj M3xiQj8ab5RfeZtWOZjwMZCGXe1FLk2VoyyHZXSzfFmSODldIDIn7c4QctjHyauU t5nUmEERaGLzk56DGPoApIc+9/MlNRnMVQd/Vyjo5b0K17NzBjYgKzeyBnrg8tBR /wmn1rk1ZeD2FWX8t+3JMH01w6ZBgjtoIXHSooa5hyX4HVrZzu/eg4zEVkUCMP5l 1dIh5UmwEphlhS+92Wjbc58KHgR9v06WJI7A2MUtbCE0znKeO9XAd7OorB0QAj8u /ieAGJXMetBFGEgVkzzMzvidAgdSUKIoIcNvsRzTlMJfZDAvLXCFlCWLzrVbULMh ba90raTvFq25t1ZE0e89IUy0DL2Gltxn20ion2kTZ44pxqK7GiEwzjnhk8mI5Pgg 799mtHQvU7kXW95hVnc4U/wANZzVKG9Wr9kksFHzz32++2xKtTn652za3+5HDnYz twGMlO2gvfwTpNpQ+Z7KYHAo/pEpkXOYM62NKiqqSSZib0TTdeP23wnzDN7hEm3o LSXdKcUM9Up6O8mo+U2kEBa4ixAHVK3DGacnzgGyKCX3THNsVCtapeFhBCfV0bWh fRSnEowqiKkqgPNtEPcW34642KvHhWEV08IaWalQy9IBMt8iMjVzZDMHbKfzFnQh tm7y4nEOB+gR46V9YYCPTEchdKDENlixb7RTMzWa9m7zPI/KBJSLVSc18Yg2iZoD ygy16oq+EPSmwHYxd/FA8I8KE8850Oke7NmBx4qp1mEuqXIDQl/k3RuYpvbcXr9t YcclacurQEZDp2zj+GKiwdX49hRJpdbgzWxqNoDV5fsToE/qEO1ajDc2f8/Kar4e tXzwmJi67thcTECp+esWsEbkUsd1oKJ/n3yMK9bRoFrinlAw+QqClaalPQ4+NUbO xzjbC6+3f3s5eGvjpikuL/T9bGZDCFNq+Sq+G4+gnv1vfYuliFW4KpiwBOQsBsZL badjMsCI7gosFpiFjekg9FualMcVFmMr6mYSAFO2Zcf8lyyMT2FSn2QhVPceJLGb dHXDTM4nakGTTFoDB2LCOlg6lnya4UtsuCYSc26YXMD5RdZxxaSNfnERO7azGG8H d1zkiNoYvhOnfwwgVjJfrN8r2fLPfJlrmUqiH+SIs+U5b5fSJoyMiuR8bylggTSg /SBh7ldvFFjsLH+f8u45MYqKbxNogDvwYaem/ODZx/MAq73G3zoJODwYLAfmJ+4A sm5ExSufKEOCHoC1XGfK07TLUVWiQF9bHvqYBk9nRTAhmRooHj/famLjw1YmsnbG lsE4k9pdfR3d/d7cHDdZVU6kQD0boi/FAV4= ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/08DCD1C616F5D272

http://decoder.re/08DCD1C616F5D272

Targets

    • Target

      revil-fixed.exe

    • Size

      126KB

    • MD5

      329b8aaea517a511908683b56446db99

    • SHA1

      9abe20a9c460a3e530cb96658541c6d25700a529

    • SHA256

      c09c691d40d8b935de4b60c92e1d4fc85f409fb546fd4a5e5b5483ae150fbf20

    • SHA512

      172d290abe8fef35e8bea43319dc68092c61389257c73e94fcde68f67f97022c1bbda1fe50cd35775bda6e2473af1bad0e5cdb2ff7060e8365bbbe4765a3b3fa

    • SSDEEP

      1536:oxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6QdZls8XzUXiWr4X5Fg:oMhQNDEtb3A2ZHjUyWr4X5FTDUA

    • Modifies Windows Firewall

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks