General

  • Target

    2025-04-21_f94d17b5f232e9cfd2255ca9823cb18a_darkside_elex_lockbit

  • Size

    147KB

  • Sample

    250421-qq281avxes

  • MD5

    f94d17b5f232e9cfd2255ca9823cb18a

  • SHA1

    633e11c6b1829076318478e41658fdcd432f6230

  • SHA256

    ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f

  • SHA512

    45d40fc2a9fb331f12a8cf22f3f47ccbe7e5a9ed4438dcc98c2695028545360046f6d09bc5f084aeece475c29dd6975c5525b0231ad2bd29b218e7a3507881c3

  • SSDEEP

    3072:O6glyuxE4GsUPnliByocWepbEOUgwAvmR:O6gDBGpvEByocWexsgwImR

Malware Config

Extracted

Path

C:\jErs0FgGP.README.txt

Family

braincipher

Ransom Note
*** Welcome to Brain Cipher Ransomware! *** Dear managers! If you're reading this, it means your systems have been hacked and encrypted and your data stolen. *** The most proper way to safely recover your data is through our support. We can recover your systems within 4-6 hours. In order for it to be successful, you must follow a few points: 1.Don't go to the police, etc. 2.Do not attempt to recover data on your own. 3.Do not take the help of third-party data recovery companies. In most cases, they are scammers who will pay us a ransom and take a for themselves. *** If you violate any 1 of these points, we will refuse to cooperate with you!!! ATTENTION! If you do not contact us within 48 hours, we will post the record on our website: vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion 3 steps to data recovery: 1. Download and install Tor Browser (https://www.torproject.org/download/) 2. Go to our support page: http://brain4zoadgr6clxecixffvxjsw43cflyprnpfeak72nfh664kqqriyd.onion This page can take up to 30 minutes to load. 3. Enter your encryption ID: DOuB5Pp206I1khMQMjQLVqnpqbROD+iJrJWwtl92dTQLsNqq8RdnSymqONiThx7G1rN+ddOiF8kXtGc3n10XdIN3Q1WFk1 Email to support: [email protected]
URLs

http://vkvsgl7lhipjirmz6j5ubp3w3bwvxgcdbpi3fsbqngfynetqtw4w5hyd.onion

http://brain4zoadgr6clxecixffvxjsw43cflyprnpfeak72nfh664kqqriyd.onion

Targets

    • Target

      2025-04-21_f94d17b5f232e9cfd2255ca9823cb18a_darkside_elex_lockbit

    • Size

      147KB

    • MD5

      f94d17b5f232e9cfd2255ca9823cb18a

    • SHA1

      633e11c6b1829076318478e41658fdcd432f6230

    • SHA256

      ec089cdd699fafbeb3cfd7dc68ac16f556c3456c7f7a57984030ae8975d8267f

    • SHA512

      45d40fc2a9fb331f12a8cf22f3f47ccbe7e5a9ed4438dcc98c2695028545360046f6d09bc5f084aeece475c29dd6975c5525b0231ad2bd29b218e7a3507881c3

    • SSDEEP

      3072:O6glyuxE4GsUPnliByocWepbEOUgwAvmR:O6gDBGpvEByocWexsgwImR

    • Brain Cipher

      Ransomware family based on Lockbit that was first observed in June 2024.

    • Braincipher family

    • Renames multiple (7637) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks