General

  • Target

    revil-fixed.exe.bin

  • Size

    126KB

  • Sample

    250328-196qmsswcy

  • MD5

    329b8aaea517a511908683b56446db99

  • SHA1

    9abe20a9c460a3e530cb96658541c6d25700a529

  • SHA256

    c09c691d40d8b935de4b60c92e1d4fc85f409fb546fd4a5e5b5483ae150fbf20

  • SHA512

    172d290abe8fef35e8bea43319dc68092c61389257c73e94fcde68f67f97022c1bbda1fe50cd35775bda6e2473af1bad0e5cdb2ff7060e8365bbbe4765a3b3fa

  • SSDEEP

    1536:oxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6QdZls8XzUXiWr4X5Fg:oMhQNDEtb3A2ZHjUyWr4X5FTDUA

Malware Config

Extracted

Path

C:\Program Files (x86)\wt6c1-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension wt6c1. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C12660539403CA53 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/C12660539403CA53 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: WiMVuyGV+IxZ1OahWywq+bipKRHxIJ7DLyOrMayISI0alp+RUJze/jDHGMdGLev6 +e9fU0KNlGxfUJODMMoLSh4xoI7ZQ1PmN3sqkMBzrF2cumNl+k0vUzvmf5cELhzV 3PBg2Udj//rZGOYbKjJh9d45X0A0nZeXcrP4tE2VbbDouZgofBDRtVOPxShsaPmc tnPBeMcuhsqDGhIVVO+NTTrMLypmkRSM5LlJXMEXGjMxea0f74cJMSpFsE3NuTXv B1CqGr5RZq2M0vHuArZzfpZNGkyTalpnnnZkAwc39ZfxJc8UwWhnL/fkX1F/39z1 ZULz7bklqvyvvhJs8xam9jibTMAWx/5KBbkeEUn/TK65c2HRG7cz+IoIUh4Vr760 bCuywDl9WSOLHGrkx34QVOC7jLx8XXMqqNeqMSMPB5gK4xLStsiW/MJA4LkEWYCc MxK/IkRWw0cGJzyow/dUPpiTwtVqrT7RAx6rxE8j7Psi5Xjbg8PBjr/fiydxo19X KorfTwMM1i8suEWaO1/Xb+XbrS8c33ooamzfpzWZJpANxRZM7fGSutKI/ZeLsDiu L7h86WAxL1k7Wl/78Ch+IC65nUWTz5/DzPe/6tP0V+qd0cPK2FpLfwOAWRE8/RYS 9HizgvyPCXIx85YgWQ+0EtuXYMkgyLrbfaVvZxpm51cyjxhYfjVaqQxKilHqO5PU rENwH/2BAsWBzEmSJm+0mB1T+1mqiRhh/+7aNcgtwpULy66k4cpxsfyXfDcKK2Nn ZirCGlfvZJjKpyZyRBrOR37hoyNzT/NwP51uHg5WF5JfSsTeAqCb+5KnFU45lzv4 4YPP3mZBG+icVDF0SIJ8J6C+MRzeg4Zj4DkBUkR5k3Uxu6lRxduxiDKgqXCugI7h E4LJpOhPewcJ+NieIIRBuCaqebnuHS3w9Vx0I9S92C4mXofgkV8b6ZmQkk+VvbJo DajFAMPFic3eO3QUU6OUa0LI2rktmvDG/x/HSddHv2+bo3vfPeSf1GT5dNLoB9vB 7Ptc+q6Pl3pNik+NMmZncIHyNbeUuq9foqiP9les9OQ8CnDcKASdZnSuWlrNbHkf Ds4qgSY3WmaNCAFVslq31ins35FZ7azjY4GckH0uWoW2ExPqnqa/dMB8ABZCD6al RNaIkYlYyFgYqAp0u6S5/FqaZLMKNsaStOIiSUeOQkDAf0mZv9VgjFHY2kmj4XRs VL5X5HLipA0nT/gD5bRoVGr2MeteCCUiW3zGk6ylnKw3CpyQ9iN7PBRDwI10xdjy glEWGDFqKGRazl82qY4Yz7boh/W8otKg29pOcz7vpUJuwrMyxMMNDsw2I+O76haz LygpDwM/WRkmgVHyp0bwVs7bbCYE7kvFoqA= ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/C12660539403CA53

http://decoder.re/C12660539403CA53

Targets

    • Target

      revil-fixed.exe.bin

    • Size

      126KB

    • MD5

      329b8aaea517a511908683b56446db99

    • SHA1

      9abe20a9c460a3e530cb96658541c6d25700a529

    • SHA256

      c09c691d40d8b935de4b60c92e1d4fc85f409fb546fd4a5e5b5483ae150fbf20

    • SHA512

      172d290abe8fef35e8bea43319dc68092c61389257c73e94fcde68f67f97022c1bbda1fe50cd35775bda6e2473af1bad0e5cdb2ff7060e8365bbbe4765a3b3fa

    • SSDEEP

      1536:oxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6QdZls8XzUXiWr4X5Fg:oMhQNDEtb3A2ZHjUyWr4X5FTDUA

    • Modifies Windows Firewall

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks