General
- Target 7c1bf612c2d3e3c30544b5865bcca48263aa1a36129efc2844fa21e97ecfbe0a
- Size 295KB
- Sample260720-lty9asdx5p
- SHA256 7c1bf612c2d3e3c30544b5865bcca48263aa1a36129efc2844fa21e97ecfbe0a
Score
10/10
Malware Config
Extracted
Ransom Note
- How to Restore Your Files We hacked your company successfully All files have been stolen and encrypted by us If you want to restore files or avoid file leaks, please send 2.03317 bitcoins to the wallet 1GequkXF8tEYrfPhpY79TrV7xRTMargC92 If money is received, encryption key will be available on TOX_ID: D6C324719AD0AA50A54E4F8DED8E8220D8698DD67B218B5429466C40E7F72657C015D86C7E4A Send money within 3 days, otherwise we will expose some data and raise the price Don't try to decrypt important files, it may damage your files Don't trust who can decrypt, they are liars, no one can decrypt without key file If you don't send bitcoins, we will notify your customers of the data breach by email and text message And sell your data to your opponents or criminals, data may be made release SSH is turned on Firewall is disabled
Wallets
-
1GequkXF8tEYrfPhpY79TrV7xRTMargC92
Extracted
Ransom Note
- How to Restore Your Files We hacked your company successfully All files have been stolen and encrypted by us If you want to restore files or avoid file leaks, please send 2.0781 bitcoins to the wallet 1PAFdD9fwqRWG4VcCGuY27VTW8xPZmuF1D If money is received, encryption key will be available on TOX_ID: D6C324719AD0AA50A54E4F8DED8E8220D8698DD67B218B5429466C40E7F72657C015D86C7E4A Send money within 3 days, otherwise we will expose some data and raise the price Don't try to decrypt important files, it may damage your files Don't trust who can decrypt, they are liars, no one can decrypt without key file If you don't send bitcoins, we will notify your customers of the data breach by email and text message And sell your data to your opponents or criminals, data may be made release SSH is turned on Firewall is disabled
Wallets
-
1PAFdD9fwqRWG4VcCGuY27VTW8xPZmuF1D
Targets
-
- Target ESXiArgs/ESXi-backdoor/local.sh.txt
- Size 1KB
- SHA256 825201b4e4648dcb66cbe698a025eb6187fc20de9cc02fff31c964a3ee8627c9
Score1/10 -
- Target ESXiArgs/ESXi-backdoor/vmtools.py.txt
- Size 1KB
- SHA256 d1cbfd7553aed39de09f2b6a2609a2b3cabe8a5ea47757e49d032da137e5c04c
Score1/10 -
- Target ESXiArgs/infected file/ransom.html
- Size 1KB
- SHA256 d9704b1c834ec856cf50b52a63fe4265f57afcd4e39f77e5ca35a2dc5df0ea59
Score3/10 -
- Target ESXiArgs/ransomware file/encrypt
- Size 47KB
- SHA256 11b1b2375d9d840912cfd1f0d0d04d93ed0cddb0ae4ddb550a5b62cd044d6b66
Score1/10 -
- Target ESXiArgs/ransomware file/encrypt.sh
- Size 3KB
- SHA256 10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459
Score7/10-
File and Directory Permissions Modification
Adversaries may modify file or directory permissions to evade defenses.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
- Target ESXiArgs/ransomware file/index.html
- Size 1KB
- SHA256 ab4e5c3c00fe7070099180ac42d31042809a643b4ee30f8cb57ae0ae8e3a240b
Score3/10
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Tasks
static1
Score
10/10
behavioral1
Score
1/10
behavioral2
Score
1/10
behavioral3
Score
1/10
behavioral4
Score
1/10
behavioral5
Score
1/10
behavioral6
Score
1/10
behavioral7
Score
1/10
behavioral8
Score
1/10
behavioral9
Score
3/10
behavioral10
Score
3/10
behavioral11
Score
1/10
behavioral12
Score
7/10
behavioral13
Score
7/10
behavioral14
Score
1/10
behavioral15
Score
1/10
behavioral16
Score
3/10
behavioral17
Score
3/10