General
- Target 20217b60553a550c5155ec301a95032b61eadb25d566ae32c5ce0fd59998f2b7
- Size 113.8MB
- Sample260218-p7apmses6f
- SHA256 20217b60553a550c5155ec301a95032b61eadb25d566ae32c5ce0fd59998f2b7
Malware Config
Extracted
-
netwire
-
londonkc.zapto.org:20114
-
activex_autorun
true
-
activex_key
{K0457A6I-AG86-4U3N-827E-FV3R34144863}
-
copy_executable
false
-
delete_original
false
-
host_id
123456
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
FKEDHidl
-
offline_keylogger
true
-
password
Password
-
registry_autorun
true
-
startup_name
NetWire
-
use_mutex
true
Extracted
-
cobaltstrike
-
http://192.168.239.128:80/OqCZ
-
user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; MAGWJS)
Extracted
-
systembc
-
107.172.197.105:4016
-
dns
5.132.191.104
92.163.33.248
206.189.120.27
Extracted
-
gafgyt
-
51.15.0.28:666
Extracted
-
stealc
-
b5
-
http://45.200.148.115
-
url_path
/0a616124ff2f2b69.php
Extracted
-
predatorstealer
-
http://florapansiyonotel.com/images/jaf3/
Extracted
-
latrodectus
-
https://aytobusesre.com/live/
-
https://scifimond.com/live/
-
group
Littlehw
-
user_agent
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)
Extracted
-
zebrocy
-
/managment/cb-secure/technology.php
Extracted
-
pony
-
http://arabnotification-001-site1.btempurl.com/dd.php
-
payload_url
http://arabnotification-001-site1.btempurl.com/shit.exe
Extracted
-
sodinokibi
-
$2a$10$QxsCf5cdia/Z/FajTwcMlei3GljcoLzkvZC78fqd3ac2xdlebUdjW
-
5012
-
classycurtainsltd.co.uk
-
hairstylesnow.site
-
happyeasterimages.org
-
catholicmusicfest.com
-
aunexis.ch
-
zweerscreatives.nl
-
carlosja.com
-
mooglee.com
-
lange.host
-
siliconbeach-realestate.com
-
galserwis.pl
-
xtptrack.com
-
bildungsunderlebnis.haus
-
linnankellari.fi
-
real-estate-experts.com
-
eglectonk.online
-
panelsandwichmadrid.es
-
comparatif-lave-linge.fr
-
tuuliautio.fi
-
winrace.no
-
net
false
-
pid
$2a$10$QxsCf5cdia/Z/FajTwcMlei3GljcoLzkvZC78fqd3ac2xdlebUdjW
-
prc
dbsnmp
mspub
msaccess
infopath
thunderbird
onenote
oracle
sql
xfssvccon
wordpad
dbeng50
encsvc
agntsvc
thebat
steam
sqbcoreservice
ocssd
mydesktopqos
excel
isqlplussvc
visio
firefox
synctime
ocautoupds
outlook
winword
mydesktopservice
tbirdconfig
ocomm
powerpnt
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damage of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
5012
-
svc
svc$
sql
memtas
backup
sophos
mepocs
veeam
vss
Extracted
-
blackmatter
-
3.0
-
4e591a315c54e8800dae714320555fa5
-
Username
-
Password
yhU6VJ$&
-
Username
-
Password
RPo@ndf9
-
Username
-
Password
DH5U87@rA0ELa2
-
https://fluentzip.org
-
http://fluentzip.org
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
-
darkcomet
-
Guest16
-
127.0.0.1:1604
-
DC_MUTEX-AC8ZNXK
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
MEcP6YegefHK
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Extracted
-
metasploit
-
windows/download_exec
-
http://158.247.204.245:80/OuIO
- headers User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.135 Safari/537.36
Extracted
-
qakbot
-
403.573
-
AA
-
1649660679
-
41.228.22.180:443
-
47.23.89.62:995
-
176.67.56.94:443
-
103.107.113.120:443
-
148.64.96.100:443
-
47.180.172.159:443
-
181.118.183.98:443
-
140.82.49.12:443
-
103.87.95.133:2222
-
96.21.251.127:2222
-
197.167.62.14:993
-
46.107.48.202:443
-
24.43.99.75:443
-
172.115.177.204:2222
-
80.11.74.81:2222
-
66.98.42.102:443
-
75.99.168.194:61201
-
173.174.216.62:443
-
45.9.20.200:443
-
39.41.158.185:995
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Extracted
-
gozi
-
build
217030
Extracted
-
cobaltstrike
-
0
-
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Extracted
-
sodinokibi
-
$2a$10$yAMP3nIcT2cdDmxcWGfMSO8kdqUEiAFW/M3lwAzFqERF9XglgmAUi
-
4525
-
qualitus.com
-
centuryrs.com
-
gw2guilds.org
-
pointos.com
-
zzyjtsgls.com
-
coding-marking.com
-
daniel-akermann-architektur-und-planung.ch
-
qualitaetstag.de
-
tstaffing.nl
-
abogadosadomicilio.es
-
arteservicefabbro.com
-
mirjamholleman.nl
-
farhaani.com
-
mrsplans.net
-
buymedical.biz
-
imperfectstore.com
-
classycurtainsltd.co.uk
-
ihr-news.jp
-
ceid.info.tr
-
kamienny-dywan24.pl
-
net
true
-
pid
$2a$10$yAMP3nIcT2cdDmxcWGfMSO8kdqUEiAFW/M3lwAzFqERF9XglgmAUi
-
ransom_oneliner
---=== Sodinokibi Ransomware ===--- All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your computer has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. I suggest you read about us on the Internet, we are known as "Sodinokibi Ransomware". For example, this article: https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread Pay attention to that: "How Much Data Is Decrypted with a Ransomware Decryptor? In Q2 2019, victims who paid for a decryptor recovered 92% of their encrypted data. This statistic varied dramatically depending on the ransomware type. For example, Ryuk ransomware has a relatively low data recovery rate, at ~ 87%, while Sodinokibi was close to 100%. " Now you have a guarantee that your files will be returned 100 %. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. If you have problem with connect, use strictly TOR version 8.5.5 link for download TOR version 8.5.5 here: https://filehippo.com/download_tor_browser_for_windows/ When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
4525
-
svc
sql
mepocs
vss
veeam
svc$
memtas
sophos
backup
Extracted
-
meduza
-
kapitan
-
176.124.204.206
-
anti_dbg
true
-
anti_vm
true
-
build_name
kapitan
-
extensions
.txt
-
grabber_maximum_size
1048576
-
port
15666
-
self_destruct
false
Targets
-
- Target capa-testfiles-master/.github/check_runtimes.py
- Size 2KB
- SHA256 23b0aabf3968db040b5a0e562bca67eabeda1f3356f88485761138b4c8ff8929
Score3/10 -
- Target capa-testfiles-master/.github/check_sample_filenames.py
- Size 3KB
- SHA256 e7788d67cfe6817e48ccf949e577912437133fa83704ceb096eb3bf21c95346e
Score3/10 -
- Target capa-testfiles-master/009c2377b67997b0da1579f4bbc822c1.exe_
- Size 92KB
- SHA256 f58c502a1f26f8e754caa1adb73df3714e54b256383becaedc4166aacad15a57
Score10/10-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Dharma family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (831) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Drops startup file
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-
- Target capa-testfiles-master/02179f3ba93663074740b5c0d283bae2.exe_
- Size 261KB
- SHA256 39fb2b683dacbaceb78995cd4cedff87ae1514e8aa3678de5deec7ccec187680
Score3/10 -
- Target capa-testfiles-master/021f49678cd633dc8cf99c61b3af3dda.exe_
- Size 87KB
- SHA256 dbef9d81aa5c47e97f966034dacd991039376aeb179a0df12e82a7e4f6179c34
Score10/10-
NetWire RAT payload
-
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
-
Netwire family
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Adds Run key to start application
-
- Target capa-testfiles-master/034b7231a49387604e81a5a5d2fe7e08f6982c418a28b719d2faace3c312ebb5.exe_
- Size 71KB
- SHA256 034b7231a49387604e81a5a5d2fe7e08f6982c418a28b719d2faace3c312ebb5
Score6/10-
Adds Run key to start application
-
- Target capa-testfiles-master/039a6336d0802a2255669e6867a5679c7eb83313dbc61fb1c7232147379bd304.exe_
- Size 32KB
- SHA256 039a6336d0802a2255669e6867a5679c7eb83313dbc61fb1c7232147379bd304
Score3/10 -
- Target capa-testfiles-master/03b236b23b1ec37c663527c1f53af3fe.dll_
- Size 566KB
- SHA256 6e730ea7b38ea80f2e852781f0a96e0bb16ebed8793a5ea4902e94c594bb6ae0
Score1/10 -
- Target capa-testfiles-master/03bb32d43885e83bc56c0b2bcad6f0c5ea40402763b7057056c654990022471b.dll_
- Size 13KB
- SHA256 03bb32d43885e83bc56c0b2bcad6f0c5ea40402763b7057056c654990022471b
Score3/10 -
- Target capa-testfiles-master/055da8e6ccfe5a9380231ea04b850e18.elf_
- Size 16KB
- SHA256 974cfecf7561cc6983e8c6f882f1c06b95e9134b0f38ec6373a5ad16b20aeaae
Score1/10 -
- Target capa-testfiles-master/0596c4ea5aa8def47f22c85d75aaca95.exe_
- Size 184KB
- SHA256 377fdff7fd24bf9257447480a8061e0380902f795ac5f8aac3738663b6503a3d
Score3/10 -
- Target capa-testfiles-master/068a76d4823419b376d418cf03215d5c.exe_
- Size 243KB
- SHA256 39655d8f0d03173bd98de4d6f0c9bde51bc7ea0deed3a644ccd5d7732052e9c6
Score8/10-
Server Software Component: Terminal Services DLL
-
Loads dropped DLL
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory
-
- Target capa-testfiles-master/071f2d1c4c2201ee95ffe2aa965000f5f615a11a12d345e33b9fb060e5597740.dll_
- Size 642KB
- SHA256 071f2d1c4c2201ee95ffe2aa965000f5f615a11a12d345e33b9fb060e5597740
Score1/10 -
- Target capa-testfiles-master/0731679c5f99e8ee65d8b29a3cabfc6b.exe_
- Size 451KB
- SHA256 38a41e8128ae3955d541c8a00a93de1cd10a01c58368c8254a35659f8627ba30
Score3/10 -
- Target capa-testfiles-master/0761142efbda6c4b1e801223de723578.dll_
- Size 8.7MB
- SHA256 94a9155bed7e9d2752f7d861a608ccfeade029379f734220c5a1bbc1b563ed0e
Score1/10 -
- Target capa-testfiles-master/0796f1c1ea0a142fc1eb7109a44c86cb.exe_
- Size 44KB
- SHA256 3400a7df9ec3dc8283d5ac7accb6935691e93feda066cc46c6c04d67f7f87b2b
Score8/10-
Tries to connect to .bazar domain
Attempts to lookup or connect to a .bazar domain, used by BazarBackdoor, Trickbot, and potentially others.
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
- Target capa-testfiles-master/07f7846bbcda782e5639292ad93907eb.exe_
- Size 24KB
- SHA256 a52c3792d8cef6019ce67203220dc191e207c6ddbdfa51ac385d9493ffe2a83a
Score7/10-
Drops startup file
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Defense Evasion
Direct Volume Access
1Indicator Removal
3File Deletion
3Modify Registry
2Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1