General

  • Target

    revil-fixed.exe

  • Size

    126KB

  • Sample

    250328-2bpvxatr14

  • MD5

    329b8aaea517a511908683b56446db99

  • SHA1

    9abe20a9c460a3e530cb96658541c6d25700a529

  • SHA256

    c09c691d40d8b935de4b60c92e1d4fc85f409fb546fd4a5e5b5483ae150fbf20

  • SHA512

    172d290abe8fef35e8bea43319dc68092c61389257c73e94fcde68f67f97022c1bbda1fe50cd35775bda6e2473af1bad0e5cdb2ff7060e8365bbbe4765a3b3fa

  • SSDEEP

    1536:oxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6QdZls8XzUXiWr4X5Fg:oMhQNDEtb3A2ZHjUyWr4X5FTDUA

Malware Config

Extracted

Path

C:\Users\6n1v62pf-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 6n1v62pf. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E0896972506E9A97 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/E0896972506E9A97 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: PwtVeVR8xcNPaJQ4609Megqy+5FQ7YyMzpzvJM5G5t23aEYsn9tGy9Et80vAd9X2 tzZT88S6wEagVI5WU3Wq9VsRY86PfpIRcvW0eWr6E1VWi+6q8rXOcnxreHPD1seE ybcaZLogsbgMVoAWoQyUm9yxhYRFZ1200Fheh33uwf+xs9UJ4xOSgR/HcgU5HxrF 7aJmXgMFJN7tAybtoQtfxtKNul3+yET1NLBDwK19VsoP/X+p05fk48vcNsZaxcVO wrF026jPVBHlGDT6MDdx5OBIJZQpdxY4x+acQrzfB36Y85GCuptcYshqTDB8AQV5 Pt8N4a/Y6aA7sPu4FAiVWcFi9bjwOIDolRsXlpAO1xLq0Mayb3IxbgZx/Xy62Qk+ f4gTwpKWqLzBFJVetYpai9HPvXfC17ngBRpRH42NOxZwQ1EMR95r7049cS4LHD// 1uYpZy2xnoCK1yfH6uLJ9txkAsk8mWJrHeIzjGfVvFddS95aDXvPXprM8it+ee/y G2mDiEB07hmo3+5CmRtkjXVXvagGE8WBci2k1+mUPjvHBkCFQ8FCDBTP6Ua/PrHU eefGhKlOWXJhn+t/ytzBoWdDo4EazvzUt2L2FLNCh09tQR9VpTB03Uj0eEXmwyWC ULFKbJYYsbbln/Fr2hjm/EtycddwdJuWq03GJw64LXn31J1CdufiqM5MSYoMUIXy Bj/h0B8wJbwtyXa72g+4O3NSgiXmOGb8YxOvJei/+GOJGYP65lrZ8me5PsMnlAuX MggxsKrgZEejooBiTuN2p9geUidKdUseToeJ/YqIjksD1lXC5nVoNMNCgbKmmqfi V8pMW+n3fJ54cExF2hpqi3QNizNkBw5st962miUsnqqDS1oZ+mBjYO7b8nMMBsp3 A14x33kcEZS6Glc/kAG+hLJ8X4a/g1zbzZkcXElhD4mmbyWTpt4wsBw1903zzrSq IoGEFeu0Y3QGLZItl+mAoBd5U/VGB6QlCJXcfsgYzC+bIQf7MdeOjc20dXVgdkwp 8ykGZ8ZMrKH8StCbm6kGsgSbidgu3wBtOP+2IRU3BKRtpIVtDMfJVqegLx+CsJ7K n2psfR8qHxtzL/QB3AuAW7kgVifXIFqyeS8BAzNx/TDhQ4SW1rpBZwLeMjrcmlzS 73kHarCivwVtLCnQO3pjgXIgo0kPj7qQWggTEImsUyAYPVeu+kO36CWCVQH6uIua 5TBINB9UwX9GgoGkzG0nXqoI/oI8gYuHygXGihisNc8NwDE2McRueJOKKzOW1ITs NHuycVff2rrd4ntrGen0rHgr5zGy4ElfmOcTcI+D88jyARDDSdKYwEDqP1Sdxmd8 Ppgm7hhL3mkeCFCcQ60m2Fqa4RoQZdqjoOM= ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E0896972506E9A97

http://decoder.re/E0896972506E9A97

Extracted

Path

C:\Program Files (x86)\956w42-readme.txt

Ransom Note
---=== Welcome. Again. ===--- [-] Whats HapPen? [-] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension 956w42. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FB777F1C95764FDB 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/FB777F1C95764FDB Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: dq3nxfFR5Axnsp7qVHuA3Ij7dk/GczYNFF1wrwyqEpQ8sO5YQCyB69VChcNvIMzl JgNZVYDTfVehsPMMP4EwMClkXwBN+x9zlryuFvjPUWjHvzXrBfrv2bcNm28jatdh UubJelg36PcJofPsuFvOg69bxULPrWQfMTWkxjW9aljxr22dPdRIsIVntdNngdz7 eSZza9l6HMaCEEBnRmgpQUgPRkqbIcvluzMTy092MWTZDcCSNev3cK/Kzvns3hGP 0sp3iIyzqdChwfi7R+SXuC7T7EJ2CEJHxzkXyOPkFIIqzecWVD+ykCFfoVV7qre1 xEadW85iTmfiHgX73XmQdb+BRc3fu6pXBlvpsZ2iAfUiV4eS39KYktIAF9HAv4Pe n8GUUc/7SmCfNxxQgvH0hNbExo3sm7QMv+xDmXe83ArkjfyWzYjJv0yJSwiwU8Jd qsgqwInf2Ee7zBF7Cz4MFGMpqfBtduEY7QLB7EdCgCbo68qFtRG7C90NwypV34iH 59acLEE+9SmcOSctt/yc3zQxT0D4z6IXOGrTulPI6kOD/YtBjzdqrnOr2F/miPqy 5qWIZNAEQYZ5K5TIKCHfDiDCHX/vA5S3/LbLQFuRGiE0+MKSqMT2BM9f17Es/JjN yeOhNsih1fVUXyVAzh0w6NxowbUN2WdI0uKvG0+0otYcvmmH4PohemFYNLx+YV/Q fgkaPB5nT9l35xfA+BDAI5BZTNR62oBTZwEPM3No3pInZIt1Wh2drKVp91azoXv/ or5GEckx6uslUMLPXyKKcEwAykoCAlsq1B/7E8by0g0pyLfdcKHSlGNK3wg4jaKW Rtx6r/VB79Qu41yQDnmkgtVsIZLq53c/XAQTDLjckQCeiOyfV35ibxBoyHph+VFo rOV8CT6OYwmzJPKNCwOYPKOSpBF2lyLUlmcgojDUACUZdN8H4TSlLjN6ur7RZWnA wkldqumZKcUv/6ElolH15NPJCSy2cVdqy3rUCzc3SgZvat9eoKmcQcCXGKlxvBmp 9jQ+m1k7waFHOm41KWteBejrepefCbDIPp/WBM/5hytDw36u9hRd3Z4eqt4+KtpC L5SEJV9rcCcABLbukFuqdtdUb8DlorZ3qGZrfpOB/+h9m3gEkitAXZo1hk7z3Hup 1fOVCPoASl/KwUKQ3ynQcTbj+zcfup/Op6CGZIixoGA6XyklZO+YKJ3yKrlk/4K/ JAvryt1FaRp3+XfMLOEl2PURIc4QGuJzaDFD33TJb7eX8d8YUL0oNMd1iyNkAVfr OBxcjsXr8JBJ9QjzGKcRbUCSQIiA6Yt279YKGRWo+DLoJ1HC5GINyEjGMkPFmDsm +IsYCDP2jkPgO4oRLkAicOmqxB7f4qxV74FTqA== ----------------------------------------------------------------------------------------- !!! DANGER !!! DON'T try to change files by yourself, DON'T use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/FB777F1C95764FDB

http://decoder.re/FB777F1C95764FDB

Targets

    • Target

      revil-fixed.exe

    • Size

      126KB

    • MD5

      329b8aaea517a511908683b56446db99

    • SHA1

      9abe20a9c460a3e530cb96658541c6d25700a529

    • SHA256

      c09c691d40d8b935de4b60c92e1d4fc85f409fb546fd4a5e5b5483ae150fbf20

    • SHA512

      172d290abe8fef35e8bea43319dc68092c61389257c73e94fcde68f67f97022c1bbda1fe50cd35775bda6e2473af1bad0e5cdb2ff7060e8365bbbe4765a3b3fa

    • SSDEEP

      1536:oxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6QdZls8XzUXiWr4X5Fg:oMhQNDEtb3A2ZHjUyWr4X5FTDUA

    • Modifies Windows Firewall

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks