General

  • Target

    2025-04-21_8947dfad1fb06abd4a2bcffc7b54a2bd_bitrat_black-basta_cobalt-strike_elex_luca-stealer_neshta

  • Size

    459KB

  • Sample

    250421-mw29ea1xaz

  • MD5

    8947dfad1fb06abd4a2bcffc7b54a2bd

  • SHA1

    aa37e858cf6a94ac69fb24db28fe8b96dc298a4e

  • SHA256

    6677e07bcccdeb28e532bb030f2ff2e4e39049caf6a1a0f9cd7f50e6d829daac

  • SHA512

    9208be80083f4ffe7538ab420572efad3b1e6a772b2b3ae601738db73ce14a05f7e21232a57a817a4a0de740ae95840b34c72089a7b5e85fa35cf1dec716a237

  • SSDEEP

    12288:7vxplpMAX99S4B009MqyQMKNT7T2fAD8x8q:LxplpMAtU4Bl9MdQFT7T2IoOq

Malware Config

Extracted

Path

C:\Program Files\readme.txt

Family

dragonforce

Ransom Note
Hello! Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay. --- Our communication process: 1. You contact us. 2. We send you a list of files that were stolen. 3. We decrypt 1 file to confirm that our decryptor works. 4. We agree on the amount, which must be paid using BTC. 5. We delete your files, we give you a decryptor. 6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future. --- Client area (use this site to contact us): Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion >>> Use this ID: 5FECBC7033DC7AE05FECBC7033DC7AE0 to begin the recovery process. * In order to access the site, you will need Tor Browser, you can download it from this link: https://www.torproject.org/ --- Additional contacts: Support Tox: 1C054B722BCBF41A918EF3C485712742088F5C3E81B2FDD91ADEA6BA55F4A856D90A65E99D20 --- Recommendations: DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. --- Important: If you refuse to pay or do not get in touch with us, we start publishing your files. 02/02/2025 00:00 UTC the decryptor will be destroyed and the files will be published on our blog. Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion Sincerely, 01000100 01110010 01100001 01100111 01101111 01101110 01000110 01101111 01110010 01100011 01100101
URLs

http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion

http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion

Targets

    • Target

      2025-04-21_8947dfad1fb06abd4a2bcffc7b54a2bd_bitrat_black-basta_cobalt-strike_elex_luca-stealer_neshta

    • Size

      459KB

    • MD5

      8947dfad1fb06abd4a2bcffc7b54a2bd

    • SHA1

      aa37e858cf6a94ac69fb24db28fe8b96dc298a4e

    • SHA256

      6677e07bcccdeb28e532bb030f2ff2e4e39049caf6a1a0f9cd7f50e6d829daac

    • SHA512

      9208be80083f4ffe7538ab420572efad3b1e6a772b2b3ae601738db73ce14a05f7e21232a57a817a4a0de740ae95840b34c72089a7b5e85fa35cf1dec716a237

    • SSDEEP

      12288:7vxplpMAX99S4B009MqyQMKNT7T2fAD8x8q:LxplpMAtU4Bl9MdQFT7T2IoOq

    • Detect Neshta payload

    • DragonForce

      Ransomware family based on Lockbit that was first observed in November 2023.

    • Dragonforce family

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Neshta family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

    • Drops startup file

    • Executes dropped EXE

    • Modifies system executable filetype association

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v16

Tasks