General

  • Target

    2025-04-21_714b31629c37dee57038ca4e52ef65ac_darkside_elex_lockbit

  • Size

    147KB

  • Sample

    250421-p5y98at1bt

  • MD5

    714b31629c37dee57038ca4e52ef65ac

  • SHA1

    f9aa5b2dc359f3173ab555944b2fb5a914b45848

  • SHA256

    27a3cc834c1cd00ad5378c373d76957998bb54bbcfe67bbf3ae5c7be5a5a66dd

  • SHA512

    05f15b7609b862450ddd56181e1f7350d24a81486a7a2d9265e809b1577ee44b65c23c966b9efd3c3c1f836dde47c201c3239132ad921bb1727c5f402bed2187

  • SSDEEP

    3072:k6glyuxE4GsUPnliByocWepMf11O4OgfJCCrPPl8rzd:k6gDBGpvEByocWeu1RJpPN6

Malware Config

Extracted

Path

C:\KUsfyVlDo.README.txt

Family

braincipher

Ransom Note
*** Welcome to Brain Cipher Ransomware! *** Dear managers! If you're reading this, it means your systems have been hacked and encrypted and your data stolen. *** The most proper way to safely recover your data is through our support. We can recover your systems within 4-6 hours. In order for it to be successful, you must follow a few points: 1.Don't go to the police, etc. 2.Do not attempt to recover data on your own. 3.Do not take the help of third-party data recovery companies. In most cases, they are scammers who will pay us a ransom and take a for themselves. *** If you violate any 1 of these points, we will refuse to cooperate with you!!! ATTENTION! If you do not contact us within 48 hours, we will post the record on our website: vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion 3 steps to data recovery: 1. Download and install Tor Browser (https://www.torproject.org/download/) 2. Go to our support page: http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion This page can take up to 30 minutes to load. 3. Enter your encryption ID: qLRS3o7nBgYneLCCIQT5S9+wDocPid9vGWlDqWB004LvisizirSDvQ3mpA3NcJAuRWgQw0M5TcgSNEttohZcJzM2VXBrdjcx Email to support: [email protected]
URLs

http://vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion

http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion

Targets

    • Target

      2025-04-21_714b31629c37dee57038ca4e52ef65ac_darkside_elex_lockbit

    • Size

      147KB

    • MD5

      714b31629c37dee57038ca4e52ef65ac

    • SHA1

      f9aa5b2dc359f3173ab555944b2fb5a914b45848

    • SHA256

      27a3cc834c1cd00ad5378c373d76957998bb54bbcfe67bbf3ae5c7be5a5a66dd

    • SHA512

      05f15b7609b862450ddd56181e1f7350d24a81486a7a2d9265e809b1577ee44b65c23c966b9efd3c3c1f836dde47c201c3239132ad921bb1727c5f402bed2187

    • SSDEEP

      3072:k6glyuxE4GsUPnliByocWepMf11O4OgfJCCrPPl8rzd:k6gDBGpvEByocWeu1RJpPN6

    • Brain Cipher

      Ransomware family based on Lockbit that was first observed in June 2024.

    • Braincipher family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks