General

  • Target

    2025-04-21_9a4889237b6aa74e819d60fadb869f51_bitrat_black-basta_cobalt-strike_elex_luca-stealer_neshta

  • Size

    459KB

  • Sample

    250421-myqcma1xft

  • MD5

    9a4889237b6aa74e819d60fadb869f51

  • SHA1

    d66e40bc12cd60f525b049d4c7a9f3e20a0790aa

  • SHA256

    b9ee022489931c6b68b63b0ae34eb1b4ef141e9bb456e84034603a9ae04e5db9

  • SHA512

    2bb2763e830c568dcf7fe6873bc5c55c8c8ef07d1fe8423388810ceec5991bcc50a8ce039bde4c8d47920cf3e7414a5c21dc88df700cdd4364c87b99b447b36b

  • SSDEEP

    12288:7vxplpMAX99S4B009MqyQMKNT75tfAD8x8q:LxplpMAtU4Bl9MdQFT75tIoOq

Malware Config

Extracted

Path

C:\Program Files\readme.txt

Family

dragonforce

Ransom Note
Hello! Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay. --- Our communication process: 1. You contact us. 2. We send you a list of files that were stolen. 3. We decrypt 1 file to confirm that our decryptor works. 4. We agree on the amount, which must be paid using BTC. 5. We delete your files, we give you a decryptor. 6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future. --- Client area (use this site to contact us): Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion >>> Use this ID: 3E8936CF76973F8C3E8936CF76973F8C to begin the recovery process. * In order to access the site, you will need Tor Browser, you can download it from this link: https://www.torproject.org/ --- Additional contacts: Support Tox: 1C054B722BCBF41A918EF3C485712742088F5C3E81B2FDD91ADEA6BA55F4A856D90A65E99D20 --- Recommendations: DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. --- Important: If you refuse to pay or do not get in touch with us, we start publishing your files. 25/02/2025 00:00 UTC the decryptor will be destroyed and the files will be published on our blog. Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion Sincerely, 01000100 01110010 01100001 01100111 01101111 01101110 01000110 01101111 01110010 01100011 01100101
URLs

http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion

http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion

Targets

    • Target

      2025-04-21_9a4889237b6aa74e819d60fadb869f51_bitrat_black-basta_cobalt-strike_elex_luca-stealer_neshta

    • Size

      459KB

    • MD5

      9a4889237b6aa74e819d60fadb869f51

    • SHA1

      d66e40bc12cd60f525b049d4c7a9f3e20a0790aa

    • SHA256

      b9ee022489931c6b68b63b0ae34eb1b4ef141e9bb456e84034603a9ae04e5db9

    • SHA512

      2bb2763e830c568dcf7fe6873bc5c55c8c8ef07d1fe8423388810ceec5991bcc50a8ce039bde4c8d47920cf3e7414a5c21dc88df700cdd4364c87b99b447b36b

    • SSDEEP

      12288:7vxplpMAX99S4B009MqyQMKNT75tfAD8x8q:LxplpMAtU4Bl9MdQFT75tIoOq

    • Detect Neshta payload

    • DragonForce

      Ransomware family based on Lockbit that was first observed in November 2023.

    • Dragonforce family

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Neshta family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

    • Drops startup file

    • Executes dropped EXE

    • Modifies system executable filetype association

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v16

Tasks