Overview

overview

10

Static

static

3

31bc1b4078...d6.exe

windows10-2004-x64

10

31bc1b4078...d6.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    31bc1b40785709373016e2a1935803fab9b8d892ee1bc6b036557aefb7d10cd6.zip
  • Size 140KB
  • Sample260820-vap1ysfn5z
  • SHA256 75f53991446c0f1eb97ac1c91da3e28e05d85dccff0c2f9b73d7571c0e415171
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryransomware

Malware Config

Extracted

Path

  • C:\Program Files (x86)\message_to_nottco.txt

Ransom Note
  • -Mindware- What happened? Your network was ATTACKED, your computers and servers were LOCKED. Your private data was DOWNLOADED. It cannot be recovered by any means without contacting our team directly. What does it mean? It means that soon mass media, your partners and clients WILL KNOW about your PROBLEM. DON'T TRY TO RECOVER your data by yourselves. Any attempt to recover your data (including the usage of the additional recovery software) can damage your files. DON'T TRY TO IGNORE us. We've downloaded a pack of your internal data and are ready to publish it on our news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. DON'T TRY TO CONTACT feds or any recovery companies. So if you will hire any recovery company for negotiations or send requests to the police/FBI/investigators, we will consider this as a hostile intent and initiate the publication of whole compromised data immediately. To prove that we REALLY CAN get your data back - we offer you to decrypt two random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org ) https://dfpc7yvle5kxmgg6sbcp5ytggy3oeob676bjgwcwhyr2pwcrmbvoilqd.onion/chat/99a41fc7c382c073e52dcfba376158bc YOU SHOULD BE AWARE! We will speak only with an authorized person. It can be the CEO, top management, etc. In case you are not such a person - DON'T CONTACT US! Your decisions and action can result in serious harm to your company! Inform your supervisors and stay calm! �
URLs

  • https://dfpc7yvle5kxmgg6sbcp5ytggy3oeob676bjgwcwhyr2pwcrmbvoilqd.onion/chat/99a41fc7c382c073e52dcfba376158bc

Targets

    • Target
      31bc1b40785709373016e2a1935803fab9b8d892ee1bc6b036557aefb7d10cd6
    • Size 296KB
    • SHA256 31bc1b40785709373016e2a1935803fab9b8d892ee1bc6b036557aefb7d10cd6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryransomware

    • Renames multiple (7541) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks