Resubmissions
08/09/2026, 17:42
260908-v91lqsvzby1008/09/2026, 14:47
260908-r5xshastaw06/09/2026, 10:46
260906-mtz19shn5s1002/09/2026, 16:53
260902-vefcbaxhjb1002/09/2026, 16:53
260902-vd1xmaxgqd26/04/2026, 11:25
260426-njgydaas6r1024/04/2026, 20:04
260424-ys8gssbv3l1020/04/2026, 09:05
260420-k2f71sdx8l1019/04/2026, 23:18
260419-3ae5racv4n1019/04/2026, 18:21
260419-wzn1mafy4p10General
- Target Ransomware.zip
- Size 49.9MB
- Sample260321-a4h5aafy2l
- SHA256 72f6748f1c16b750d00541597668e5c306f77759dc998f65f33fe94b8c765b90
Malware Config
Extracted
-
C:\Program Files\7-Zip\DECRYPT_YOUR_FILES.HTML
- <html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>d+hRnB+z91A/Cgcj09eUnn0s9JjtHi9o+4j3XcxuUztGS49vlmsaeXkIgufM+zwcIwikgGL42stPyomxC52daFRp801b258qppieegfcIp0FyflW3cggz1L2BdRJo02nEsbAmD4IDSErtVOa7pmP9NvEsMEoZAbarJzyxcf/bD9Fl+272ECKzlS8+4PmVxohpw69rwcKx+5fgWnQ7lqPXcFw2RgGUvw+hlIb9dfbqLLJNGpfg+s8ZgR9rSmrHAr8TOrDol+v+2ThR68o6rsOUdGX/PgmjtllfR9Es0Gw29UjC+P739PIVgd3MWbL6BraP/6jNPgz+5rBIVU3WPvskA==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>
Extracted
-
metasploit
-
windows/single_exec
Extracted
-
C:\Users\Admin\README_HOW_TO_UNLOCK.TXT
- YOUR FILE HAS BEEN LOCKED In order to unlock your files, follow the instructions bellow: 1. Download and install Tor Browser 2. After a successful installation, run Tor Browser and wait for its initialization. 3. Type in the address bar: http://zvnvp2rhe3ljwf2m.onion 4. Follow the instructions on the site.
-
http://zvnvp2rhe3ljwf2m.onion
Extracted
-
C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___U4KY_.txt
-
cerber
- Hi, I'am CRBR ENCRYPTOR ;) ----- ALL YOUR DOCUMENTS, PH0T0S, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only one way to decrypt your files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_R_E_A_D___T_H_I_S_*) with complete instructions how to decrypt your files. If you cannot find any (*_R_E_A_D___T_H_I_S_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://xpcx6erilkjced3j.onion/67DB-8169-5217-0098-BAFA Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://xpcx6erilkjced3j.1n5mod.top/67DB-8169-5217-0098-BAFA 2. http://xpcx6erilkjced3j.19kdeh.top/67DB-8169-5217-0098-BAFA 3. http://xpcx6erilkjced3j.1mpsnr.top/67DB-8169-5217-0098-BAFA 4. http://xpcx6erilkjced3j.18ey8e.top/67DB-8169-5217-0098-BAFA 5. http://xpcx6erilkjced3j.17gcun.top/67DB-8169-5217-0098-BAFA ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----
-
http://xpcx6erilkjced3j.onion/67DB-8169-5217-0098-BAFA
-
http://xpcx6erilkjced3j.1n5mod.top/67DB-8169-5217-0098-BAFA
-
http://xpcx6erilkjced3j.19kdeh.top/67DB-8169-5217-0098-BAFA
-
http://xpcx6erilkjced3j.1mpsnr.top/67DB-8169-5217-0098-BAFA
-
http://xpcx6erilkjced3j.18ey8e.top/67DB-8169-5217-0098-BAFA
-
http://xpcx6erilkjced3j.17gcun.top/67DB-8169-5217-0098-BAFA
Extracted
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta
- All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Write this ID in the title of your message E7950EF8 In case of no answer in 24 hours write us to theese e-mails: [email protected] You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Targets
-
- Target Ransomware.zip
- Size 49.9MB
- SHA256 72f6748f1c16b750d00541597668e5c306f77759dc998f65f33fe94b8c765b90
Score1/10 -
- Target Ransomware/$uckyLocker.exe
- Size 414KB
- SHA256 86e0eac8c5ce70c4b839ef18af5231b5f92e292b81e440193cdbdc7ed108049f
Score8/10-
Disables Task Manager via registry modification
-
Sets desktop wallpaper using registry
-
- Target Ransomware/7ev3n.exe
- Size 315KB
- SHA256 7d373ccb96d1dbb1856ef31afa87c2112a0c1795a796ab01cb154700288afec5
Score10/10-
Modifies WinLogon for persistence
-
Seven family
-
Seven, SevenCrypt, 7ev3n
Seven aka SevenCrypt or 7ev3n is a ransomware.
-
UAC bypass
-
Modifies boot configuration data using bcdedit
-
Executes dropped EXE
-
Adds Run key to start application
-
- Target Ransomware/Annabelle.exe
- Size 15.9MB
- SHA256 716335ba5cd1e7186c40295b199190e2b6655e48f1c1cbe12139ba67faa5e1ac
Score10/10-
Modifies WinLogon for persistence
-
Modifies Windows Defender DisableAntiSpyware settings
-
Modifies Windows Defender Real-time Protection settings
-
UAC bypass
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Disables use of System Restore points
-
Event Triggered Execution: Image File Execution Options Injection
-
Modifies Windows Firewall
-
Impair Defenses: Safe Mode Boot
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
- Target Ransomware/BadRabbit.exe
- Size 431KB
- SHA256 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da
Score10/10-
BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
-
Badrabbit family
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Mimikatz family
-
mimikatz is an open source tool to dump credentials on Windows
-
Executes dropped EXE
-
Loads dropped DLL
-
- Target Ransomware/Birele.exe
- Size 116KB
- SHA256 b2dcfdf9e7b09f2aa5004668370e77982963ace820e7285b2e264a294441da23
Score5/10-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target Ransomware/Cerber5.exe
- Size 313KB
- SHA256 b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d
Score10/10-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Cerber family
-
Contacts a large (1089) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall
-
Drops startup file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
- Target Ransomware/CoronaVirus.exe
- Size 1.0MB
- SHA256 dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0
Score10/10-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Dharma family
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (804) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Drops startup file
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-
- Target Ransomware/CryptoLocker.exe
- Size 338KB
- SHA256 d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9
Score10/10-
CryptoLocker
Ransomware family with multiple variants.
-
Cryptolocker family
-
Deletes itself
-
Executes dropped EXE
-
Adds Run key to start application
-
- Target Ransomware/CryptoWall.exe
- Size 132KB
- SHA256 e036d68b8f8b7afc6c8b6252876e1e290f11a26d4ad18ac6f310662845b2c734
Score7/10-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target Ransomware/DeriaLock.exe
- Size 484KB
- SHA256 4f5bff64160044d9a769ab277ff85ba954e2a2e182c6da4d0672790cf1d48309
Score7/10-
Drops startup file
-
- Target Ransomware/Dharma.exe
- Size 11.5MB
- SHA256 6fb303dd8ba36381948127d44bd8541e4a1ab8af07b46526ace08458f2498850
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Remote Service Session Hijacking: RDP Hijacking
Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.
-
Modifies Windows Firewall
-
Sets file to hidden
Modifies file attributes to stop it showing in Explorer etc.
-
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
-
Executes dropped EXE
-
Impair Defenses: Safe Mode Boot
-
Modifies visibility of existing users in the login screen
A user account was hidden or made visible on the Windows login screen through a registry modification.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Password Policy Discovery
Attempt to access detailed information about the password policy used within an enterprise network.
-
- Target Ransomware/Fantom.exe
- Size 261KB
- SHA256 f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
Score10/10-
Fantom
Ransomware which hides encryption process behind fake Windows Update screen.
-
Fantom family
-
Renames multiple (5547) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory
-
Drops startup file
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory
-
- Target Ransomware/GandCrab.exe
- Size 291KB
- SHA256 bfb9db791b8250ffa8ebc48295c5dbbca757a5ed3bbb01de12a871b5cd9afd5a
Score3/10 -
- Target Ransomware/GoldenEye/GoldenEye.exe
- Size 254KB
- SHA256 389a7d395492c2da6f8abf5a8a7c49c3482f7844f77fe681808c71e961bcae97
Score10/10-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Executes dropped EXE
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
- Target Ransomware/GoldenEye/GoldenEye.js
- Size 365KB
- SHA256 28fd3a1d9087d7b103b7f6cfca002798b6365fe6ebcc66fa02dbb4a9e6378e71
Score10/10-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Executes dropped EXE
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
- Target Ransomware/InfinityCrypt.exe
- Size 211KB
- SHA256 f5d002bfe80b48386a6c99c41528931b7f5df736cd34094463c3f85dde0180bf
Score4/10 -
- Target Ransomware/Krotten.exe
- Size 53KB
- SHA256 e79f164ccc75a5d5c032b4c5a96d6ad7604faffb28afe77bc29b9173fa3543e4
Score8/10-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Adds Run key to start application
-
Modifies WinLogon
-
- Target Ransomware/Locky.AZ.exe
- Size 181KB
- SHA256 2e4319ff62c03a539b2b2f71768a0cfc0adcaedbcca69dbf235081fe2816248b
Score3/10 -
- Target Ransomware/NoMoreRansom.exe
- Size 1.4MB
- SHA256 2aab13d49b60001de3aa47fb8f7251a973faa7f3c53a3840cdf5fd0b26e9a09f
Score10/10-
Troldesh family
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Executes dropped EXE
-
Adds Run key to start application
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target Ransomware/NotPetya.exe
- Size 390KB
- SHA256 63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a
Score10/10-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Mimikatz family
-
mimikatz is an open source tool to dump credentials on Windows
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
- Target Ransomware/PetrWrap
- Size 473KB
- SHA256 e079fa28ea51fa98644164caf585ae3231d25372fccca1245902fb57488d4660
Score3/10 -
- Target Ransomware/Petya.A.exe
- Size 225KB
- SHA256 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739
Score10/10-
Detects Petya Ransomware
-
Petya
Petya is a ransomware written in C#.
-
Petya family
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
- Target Ransomware/PolyRansom.exe
- Size 220KB
- SHA256 1898f2cae1e3824cb0f7fd5368171a33aba179e63501e480b4da9ea05ebf0423
Score10/10-
Modifies visibility of file extensions in Explorer
-
Nabucur
Nabucur is a ransomware first seen in 2015.
-
Nabucur family
-
UAC bypass
-
Renames multiple (115) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
- Target Ransomware/PowerPoint.exe
- Size 136KB
- SHA256 9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
Score7/10-
Deletes itself
-
Executes dropped EXE
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
- Target Ransomware/RedBoot.exe
- Size 1.2MB
- SHA256 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887
Score9/10-
Renames multiple (153) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target Ransomware/RedEye.exe
- Size 10.6MB
- SHA256 9ac9f207060c28972ede6284137698ce0769e3695c7ad98ab320605d23362305
Score10/10-
Modifies Windows Defender DisableAntiSpyware settings
-
Modifies Windows Defender Real-time Protection settings
-
UAC bypass
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Disables use of System Restore points
-
Event Triggered Execution: Image File Execution Options Injection
-
Modifies Windows Firewall
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Sets desktop wallpaper using registry
-
- Target Ransomware/Rensenware.exe
- Size 96KB
- SHA256 7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a
Score7/10-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
- Target Ransomware/Rokku.exe
- Size 666KB
- SHA256 438888ef36bad1079af79daf152db443b4472c5715a7b3da0ba24cc757c53499
Score10/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (82) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target Ransomware/Satana.exe
- Size 49KB
- SHA256 683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
Score5/10-
Suspicious use of SetThreadContext
-
- Target Ransomware/Seftad.exe
- Size 48KB
- SHA256 2ebe23ba9897d9c127b9c0a737ba63af8d0bcd76ec866610cc0b5de2f62b87bd
Score6/10-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
- Target Ransomware/SporaRansomware.exe
- Size 24KB
- SHA256 7ad9ed23a91643b517e82ad5740d24eca16bcae21cfe1c0da78ee80e0d1d3f02
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1JavaScript
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Account Manipulation
1Boot or Logon Autostart Execution
5Active Setup
1Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Account Manipulation
1Boot or Logon Autostart Execution
5Active Setup
1Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1Hide Artifacts
4Hidden Files and Directories
3Hidden Users
1Impair Defenses
5Disable or Modify System Firewall
1Disable or Modify Tools
3Safe Mode Boot
1Indicator Removal
2File Deletion
2Modify Registry
14Pre-OS Boot
1Bootkit
1Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Service Discovery
1Password Policy Discovery
1Peripheral Device Discovery
2Permission Groups Discovery
1Local Groups
1Query Registry
5Remote System Discovery
1System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1