General
- Target jaffacakes118_samples.part035.rar
- Size 15.0MB
- Sample261011-wc8rhsvtct
- SHA256 dffd68bc9d57ae76db089dc69054e7d314c07411bf40f18f0a2df4b27f7972b2
Malware Config
Extracted
-
agenda
-
company_id
MmXReVIxLV
-
note
-- Qilin Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from you system/network If you refuse to communicate with us and we do not come to an agreementyour data will be published. Data includes: - Employees personal dataCVsDLSSN. - Complete network map including credentials for local and remote services. - Financial information including clients databillsbudgetsannual reportsbank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials -- Credentials Extension: MmXReVIxLV Domain: ueegj65kwr3v3sjhli73gjtmfnh2uqlte3vyg2kkyqq7cja2yx2ptaad.onion login: 6f031ccd-526a-4806-82a8-2e7d926243d4 password:
Extracted
-
C:\Program Files\instructions_read_me.txt
-
blackbasta
- ATTENTION! Your network has been breached and all data was encrypted. Please contact us at: https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/ Login ID: ae31fac0-5ef2-4d58-8434-0c644b47d85c *!* To access .onion websites download and install Tor Browser at: https://www.torproject.org/ (Tor Browser is not related to us) *!* To restore all your PCs and get your network working again, follow these instructions: - Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. It doesn't matter, who are trying to do this, either it will be your IT guys or a recovery agency. Please follow these simple rules to avoid data corruption: - Do not modify, rename or delete files. Any attempts to modify, decrypt or rename the files will lead to its fatal corruption. - Do not hire a recovery company. They can't decrypt without the key. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail. So speak for yourself. Waiting you in a chat.
-
https://aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/
Extracted
-
C:\Users\Admin\Documents\README.txt
- Baши фaйлы былu зaшифpoBaHы. ЧToбы pacшифpoBamb иx, BaM HeoбxoдиMo omпpaBиTb koд: 48533B68E604D82B6DC7|0 Ha элeкTpoHHый aдpec [email protected]. Дaлee Bы пoлyчuTe Bce HeoбxoдиMыe uHcmpykциu. Пoпыmки pacшифpoBaTb caMocmoяmeлbHo He пpиBeдym Hu k чeMy, кpoMe бeзBoзBpamHoй nomepu иHфopMaциu. Ecлu Bы Bcё жe xoTuTe пonыTambcя, mo npeдBapuTeлbHo cдeлaйme peзepBHыe konuи фaйлoB, uHaчe B cлyчae ux uзMeHeHuя pacшuфpoBкa cTaHem HeBoзMoжHoй Hи npu кakux ycлoBияx. Ecли Bы He пoлyчилu oTBeTa пo BышeykaзaHHoMy aдpecy B meчeHиe 48 чacoB (и moлbko B эmoM cлyчae!), BocnoлbзyйTecb фopMoй oбpaTHoй cBязи. ЭTo MoжHo cдeлaTb дByMя cпocoбaMu: 1) CkaчaйTe u ycmaHoBиTe Browser пo ccылкe: https://browser.yandex.ru/ B aдpecHoй cmpoke Browser-a BBeдиTe aдpec: http://d90452g1.beget.tech/ctd.html u HaжMиme Enter. Зaгpyзumcя cTpaHuцa c фopMoй oбpamHoй cBязu. 2) B любoM бpayзepe пepeйдиme пo oдHoMy aдpecy All the important files on your computer were encrypted. To decrypt the files you should send the following code: 48533B68E604D82B6DC7|0 to e-mail address [email protected] . Then you will receive all necessary instructions. All the attempts of decryption by yourself will result only in irrevocable loss of your data. If you still want to try to decrypt them by yourself please make a backup at first because the decryption will become impossible in case of any changes inside the files. If you did not receive the answer from the aforecited email for more than 48 hours (and only in this case!), use the feedback form. You can do it by two ways: 1) Download Browser from here: https://browser.yandex.ru/ Install it and type the following address into the address bar: http://d90452g1.beget.tech/ctd.html Press Enter and then the page with feedback form will be loaded. 2) Go to the one of the following addresses in any browser: http://d90452g1.beget.tech/ctd.html
-
https://browser.yandex.ru/
-
http://d90452g1.beget.tech/ctd.html
Extracted
-
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
-
makop
- ::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay in Monero(XMR) - this is one of the types of cryptocurrency, you can get acquainted with it in more detail here: https://www.getmonero.org/ .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: Please, write us to our qTOX account: A2D64928FE333BF394C79BB1F0B8F3E85AFE84F913135CCB481F0B13ADDDD1055AC5ECD33A05 You can learn about this way of communication and download it here: https://qtox.github.io/ Or use Bitmessage and write to our address: BM-NC6V9JcMRuLPnSuPFN8upRPRRmHEMSFA You can learn about this way of communication and download it here: https://wiki.bitmessage.org/ and here: https://github.com/Bitmessage/PyBitmessage/releases/ .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don’t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data. Key Identifier: XADJBkCm/YKPHcajo5n5oypZYR4Jfk39p4yy3CuKb0cyEH+lwQFDLoSVwuJbkf75VnWtT3ljc37Ea3Yf0Gh+SYsJbwSVOK9KwOSJx90oL3IvulFgaRVJxtPyUGekKCkgBYMaMQ3dCEolS0ETq1vJ8ellKSSM79cdSxsgU7WRN96JSr/nkaqakox7fgR0VCNIbjHqbJzpkakuhHtm1kBSdh5cuWny5L0OHoX10nQ+SWwudouAPSx10wb0M5S4EUUu7Eu2FQ2fEqsSD7UBnFJTddxaYgoSSKkBCTXgYxaFJ7cVgprAf6cNoBie2bGHK2tXnUAAYOO/77JQXzqTkuzo2B01o/Y1ubGlES7bLML4nlZoLvr7CJ+RKy5WzEZ3pmSLB3ZORcfDhwwHjaIk5LB73FdmSQoW5lFrZv80PQbdgUxp1roC1APsRy62p47QTnnf403t0yny5hmW40jkbX9dFXQd3GKYqAynByhlmgdxs8WSGKS1gwQ6FA3Djt8x6IETXNpjNW1Ccc+HnIA1u3tm01Q3hEl8nmC3RD/HxeAV0aWzfrUgYBHHLidymmTFr4aPDx3HnmACDd8w6QRjPuijWV7msokKmVUIoLwRpnbhdjyCoJnCVMyQe5hF6PgluWYPWiXk718oSRetxwkE3q9z57sEH7zAQg/uZiiCmqiosfE= PC Hardware ID: A07F0B66
-
https://www.getmonero.org/
-
https://qtox.github.io/
-
https://wiki.bitmessage.org/
-
https://github.com/Bitmessage/PyBitmessage/releases/
Extracted
-
C:\RESTORE_FILES_INFO.txt
-
makop
- ::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay in Monero(XMR) - this is one of the types of cryptocurrency, you can get acquainted with it in more detail here: https://www.getmonero.org/ .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: Please, write us to our qTOX account: A2D64928FE333BF394C79BB1F0B8F3E85AFE84F913135CCB481F0B13ADDDD1055AC5ECD33A05 You can learn about this way of communication and download it here: https://qtox.github.io/ Or use Bitmessage and write to our address: BM-NC6V9JcMRuLPnSuPFN8upRPRRmHEMSFA You can learn about this way of communication and download it here: https://wiki.bitmessage.org/ and here: https://github.com/Bitmessage/PyBitmessage/releases/ .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don’t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data. Key Identifier: XADJBkCm/YKPHcajo5n5oypZYR4Jfk39p4yy3CuKb0cyEH+lwQFDLoSVwuJbkf75VnWtT3ljc37Ea3Yf0Gh+SYsJbwSVOK9KwOSJx90oL3IvulFgaRVJxtPyUGekKCkgBYMaMQ3dCEolS0ETq1vJ8ellKSSM79cdSxsgU7WRN96JSr/nkaqakox7fgR0VCNIbjHqbJzpkakuhHtm1kBSdh5cuWny5L0OHoX10nQ+SWwudouAPSx10wb0M5S4EUUu7Eu2FQ2fEqsSD7UBnFJTddxaYgoSSKkBCTXgYxaFJ7cVgprAf6cNoBie2bGHK2tXnUAAYOO/77JQXzqTkuzo2B01o/Y1ubGlES7bLML4nlZoLvr7CJ+RKy5WzEZ3pmSLB3ZORcfDhwwHjaIk5LB73FdmSQoW5lFrZv80PQbdgUxp1roC1APsRy62p47QTnnf403t0yny5hmW40jkbX9dFXQd3GKYqAynByhlmgdxs8WSGKS1gwQ6FA3Djt8x6IETXNpjNW1Ccc+HnIA1u3tm01Q3hEl8nmC3RD/HxeAV0aWzfrUgYBHHLidymmTFr4aPDx3HnmACDd8w6QRjPuijWV7msokKmVUIoLwRpnbhdjyCoJnCVMyQe5hF6PgluWYPWiXk718oSRetxwkE3q9z57sEH7zAQg/uZiiCmqiosfE= Number of files that were processed is: 1151 PC Hardware ID: A07F0B66
-
https://www.getmonero.org/
-
https://qtox.github.io/
-
https://wiki.bitmessage.org/
-
https://github.com/Bitmessage/PyBitmessage/releases/
Extracted
-
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
-
makop
- ::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay in Monero(XMR) - this is one of the types of cryptocurrency, you can get acquainted with it in more detail here: https://www.getmonero.org/ .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: Please, write us to our qTOX account: A2D64928FE333BF394C79BB1F0B8F3E85AFE84F913135CCB481F0B13ADDDD1055AC5ECD33A05 You can learn about this way of communication and download it here: https://qtox.github.io/ Or use Bitmessage and write to our address: BM-NC6V9JcMRuLPnSuPFN8upRPRRmHEMSFA You can learn about this way of communication and download it here: https://wiki.bitmessage.org/ and here: https://github.com/Bitmessage/PyBitmessage/releases/ .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don’t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data. Key Identifier: Z+d8yO7Q+dwHMuVpDLt1chi6GsN/E7wNxCBJApzppWSHkGu8paNnF3xFpXc7/Xu/+7BMUAgjwxPC7lFbPIxk53xdZE8PIDp/sDP5/x1lI7gHbEnFpXyXcd8y0/f6HoEWbAUwO6SNOGajp7Hmu9CT+bH2azsjENhSx12jmPDxRiWnzbDvan2kllvPjuaNLu02JGz1Lf9SNLq3bmiK5gW5hNO0o9tcjmrh+d2M31FK8gNEbY84G2TtdEdXM32Jn4Y3pdwpQ79Y+iMbC16DLz6j4fr5Z/w1l3HE/wMqylftFwhjhndbKuLhb+j8smDhtdOzj1xBnoKxNvK+sj1uVJmFCBWY/UxU6WLI6TRUsCnTzHRXa9BlXz9Tg4KhPxxCuTDbETQ5hXGoZno+fZ8wzVP8iimem8Emq9dRzegQb54MPzs3sT/7rWz0CFWY95jXZGl2vJyVAiOXAX75IRf6nJTSuWR6/oUvDVXO00b1iymET2H6j2FCfVjCFYEEMCQJlCvXFB0S1BcDCE+kjs0AHL898Rm6gMuseRcyId1D48Iyy6EH8wRn01BidEkdkREJaXujo46ootarmaRzQn3dOYQm6MVTuNbH6mRQVVR+67qnYhCG0ZVgxtnn9XFzwJwiOIkK9VdGseKy3I49MEmGgLBQvPyeYnGiab6MHXsOLAvXlpA= PC Hardware ID: 58859655
-
https://www.getmonero.org/
-
https://qtox.github.io/
-
https://wiki.bitmessage.org/
-
https://github.com/Bitmessage/PyBitmessage/releases/
Extracted
-
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt
-
makop
- ::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay in Monero(XMR) - this is one of the types of cryptocurrency, you can get acquainted with it in more detail here: https://www.getmonero.org/ .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: Please, write us to our qTOX account: A2D64928FE333BF394C79BB1F0B8F3E85AFE84F913135CCB481F0B13ADDDD1055AC5ECD33A05 You can learn about this way of communication and download it here: https://qtox.github.io/ Or use Bitmessage and write to our address: BM-NC6V9JcMRuLPnSuPFN8upRPRRmHEMSFA You can learn about this way of communication and download it here: https://wiki.bitmessage.org/ and here: https://github.com/Bitmessage/PyBitmessage/releases/ .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don’t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data. Key Identifier: Z+d8yO7Q+dwHMuVpDLt1chi6GsN/E7wNxCBJApzppWSHkGu8paNnF3xFpXc7/Xu/+7BMUAgjwxPC7lFbPIxk53xdZE8PIDp/sDP5/x1lI7gHbEnFpXyXcd8y0/f6HoEWbAUwO6SNOGajp7Hmu9CT+bH2azsjENhSx12jmPDxRiWnzbDvan2kllvPjuaNLu02JGz1Lf9SNLq3bmiK5gW5hNO0o9tcjmrh+d2M31FK8gNEbY84G2TtdEdXM32Jn4Y3pdwpQ79Y+iMbC16DLz6j4fr5Z/w1l3HE/wMqylftFwhjhndbKuLhb+j8smDhtdOzj1xBnoKxNvK+sj1uVJmFCBWY/UxU6WLI6TRUsCnTzHRXa9BlXz9Tg4KhPxxCuTDbETQ5hXGoZno+fZ8wzVP8iimem8Emq9dRzegQb54MPzs3sT/7rWz0CFWY95jXZGl2vJyVAiOXAX75IRf6nJTSuWR6/oUvDVXO00b1iymET2H6j2FCfVjCFYEEMCQJlCvXFB0S1BcDCE+kjs0AHL898Rm6gMuseRcyId1D48Iyy6EH8wRn01BidEkdkREJaXujo46ootarmaRzQn3dOYQm6MVTuNbH6mRQVVR+67qnYhCG0ZVgxtnn9XFzwJwiOIkK9VdGseKy3I49MEmGgLBQvPyeYnGiab6MHXsOLAvXlpA= Number of files that were processed is: 795 PC Hardware ID: 58859655
-
https://www.getmonero.org/
-
https://qtox.github.io/
-
https://wiki.bitmessage.org/
-
https://github.com/Bitmessage/PyBitmessage/releases/
Extracted
-
C:\$Recycle.Bin\S-1-5-21-2091445952-3649787497-104050984-1000\FILE RECOVERY.txt
-
targetcompany
- Hello Your files are encrypted and can not be used To return your files in work condition you need decryption tool Follow the instructions to decrypt all your data Do not try to change or restore files yourself, this will break them If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB How to get decryption tool: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: 7982D4271A48130640C3494F 5) You will see payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion If you are unable to contact us through the site, then you can email us: [email protected] Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site. �
-
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
-
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
Extracted
-
C:\Users\Admin\Downloads\FILE RECOVERY.txt
-
targetcompany
- Hello Your files are encrypted and can not be used To return your files in work condition you need decryption tool Follow the instructions to decrypt all your data Do not try to change or restore files yourself, this will break them If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB How to get decryption tool: 1) Download and install TOR browser by this link: https://www.torproject.org/download/ 2) If TOR blocked in your country and you can't access to the link then use any VPN software 3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin 4) Copy your private ID in the input field. Your Private key: 788B5A1DF5E03DE3789A1BBA 5) You will see payment information and we can make free test decryption here Our blog of leaked companies: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion If you are unable to contact us through the site, then you can email us: [email protected] Waiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site. �
-
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin
-
http://wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion
Extracted
-
C:\Users\Public\Desktop\info.hta
- <!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'> <html> <head> <meta charset='windows-1251'> <title>encrypted</title> <HTA:APPLICATION ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu="no"> <script language='JScript'> window.moveTo(50, 50); window.resizeTo(screen.width - 100, screen.height - 100); </script> <style type='text/css'> body { font: 15px Tahoma, sans-serif; margin: 10px; line-height: 25px; background: #EDEDED; } img { display:inline-block; } .bold { font-weight: bold; } .mark { background: #D0D0E8; padding: 2px 5px; } .header { text-align: center; font-size: 30px; line-height: 50px; font-weight: bold; margin-bottom:20px; } .info { background: #D0D0E8; border-left: 10px solid #00008B; } .alert { background: #FFE4E4; border-left: 10px solid #FF0000; } .private { border: 1px dashed #000; background: #FFFFEF; } .note { height: auto; padding-bottom: 1px; margin: 15px 0; } .note .title { font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; } .note .mark { background: #A2A2B5; } .note ul { margin-top: 0; } .note pre { margin-left: 15px; line-height: 13px; font-size: 13px; } .footer { position:fixed; bottom:0; right:0; text-align: right; } </style> </head> <body> <div class='header'> <img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII='> <div>All your files have been encrypted!</div> </div> <div class='bold'>All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail <span class='mark'>[email protected]</span></div> <div class='bold'>Write this ID in the title of your message <span class='mark'>6EE36AF1-3352</span></div> <div class='bold'>If you do not receive a response within 24 hours, please contact us by Telegram.org account: <span class='mark'><a href='https://t.me/HostUppp'></a>@HostUppp</span></div> <div> You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. </div> <div class='note info'> <div class='title'>Free decryption as guarantee</div> <ul>Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) </ul> </div> <div class='note info'> <div class='title'>How to obtain Bitcoins</div> <ul> The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. <br><a href='https://localbitcoins.com/buy_bitcoins'>https://localbitcoins.com/buy_bitcoins</a> <br> Also you can find other places to buy Bitcoins and beginners guide here: <br><a href='http://www.coindesk.com/information/how-can-i-buy-bitcoins/'>http://www.coindesk.com/information/how-can-i-buy-bitcoins/</a> </ul> </div> <div class='note alert'> <div class='title'>Attention!</div> <ul> <li>Do not rename encrypted files.</li> <li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li> <li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li> </ul> </div> </body> </html>
-
class='mark'>[email protected]</span></div>
-
http://www.w3.org/TR/html4/strict.dtd'>
Targets
-
- Target e0930d58ea5dc910777887b7f413c52a1f36b4707bda1c22a29f3526a5498e5c.exe
- Size 873KB
- SHA256 e0930d58ea5dc910777887b7f413c52a1f36b4707bda1c22a29f3526a5498e5c
Score9/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Deletes backup catalog
Uses wbadmin.exe to inhibit system recovery.
-
Disables RegEdit via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target e133175b822a5469edb6dff81734848124470374a57bcaa8d273f0e2e08d2d95.exe
- Size 88KB
- SHA256 e133175b822a5469edb6dff81734848124470374a57bcaa8d273f0e2e08d2d95
Score10/10-
Modifies WinLogon for persistence
-
Modifies Windows Defender DisableAntiSpyware settings
-
Modifies security service
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Adds Run key to start application
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
- Target e165b3e962a2916ed4693993f1911c04b18fcbf7fbdaa824d0e57449da4e4099.exe
- Size 56KB
- SHA256 e165b3e962a2916ed4693993f1911c04b18fcbf7fbdaa824d0e57449da4e4099
Score10/10-
Family: Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Renames multiple (828) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes backup catalog
Uses wbadmin.exe to inhibit system recovery.
-
Modifies Windows Firewall
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target e258e2d37e10332739fe5467bcaa82e4b894d15a55a1dd4861ac8edc95253651.exe
- Size 354KB
- SHA256 e258e2d37e10332739fe5467bcaa82e4b894d15a55a1dd4861ac8edc95253651
Score7/10-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
- Target e2663d1ce192e322ff34230d8e81665c7763b2c6790e354f72b7de36dfde23c8.exe
- Size 2.1MB
- SHA256 e2663d1ce192e322ff34230d8e81665c7763b2c6790e354f72b7de36dfde23c8
Score9/10-
Renames multiple (1839) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops desktop.ini file(s)
-
- Target e28188e516db1bda9015c30de59a2e91996b67c2e2b44989a6b0f562577fd757.exe
- Size 681KB
- SHA256 e28188e516db1bda9015c30de59a2e91996b67c2e2b44989a6b0f562577fd757
Score10/10-
Detects BlackBasta Ransomware
-
Family: Black Basta
A ransomware family targeting Windows and Linux ESXi first seen in February 2022.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (760) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
- Target e387a1cc1a8694dc77d325a9adbc9b6f6650fe50b51896ec06a7030110912879.exe
- Size 176KB
- SHA256 e387a1cc1a8694dc77d325a9adbc9b6f6650fe50b51896ec06a7030110912879
Score10/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
- Target e400a84a81d2138cfafbad78402f58314e6a77f61926c4fc5d8f64e324492e5f.exe
- Size 182KB
- SHA256 e400a84a81d2138cfafbad78402f58314e6a77f61926c4fc5d8f64e324492e5f
Score10/10-
Family: Azov
A wiper seeking only damage, first seen in 2022.
-
Renames multiple (13095) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target e4384092476483a23d496bfd661882246d5df6ea077d3ab21ee68335feabb3ab.exe
- Size 678KB
- SHA256 e4384092476483a23d496bfd661882246d5df6ea077d3ab21ee68335feabb3ab
Score8/10-
Disables Task Manager via registry modification
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
Sets desktop wallpaper using registry
-
- Target e64edc53f3457a0608354c18f398787fc2d281a9f4246724d2d73d9ddc34a861.exe
- Size 105KB
- SHA256 e64edc53f3457a0608354c18f398787fc2d281a9f4246724d2d73d9ddc34a861
Score10/10-
Family: Makop
Ransomware family discovered by @VK_Intel in early 2020.
-
Renames multiple (193) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Downloads MZ/PE file
-
Downloads PsExec from SysInternals website
Sysinternals tools like PsExec are often leveraged maliciously by malware families due to being commonly used by testers/administrators.
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Disables service(s)
-
Drops desktop.ini file(s)
-
Network Service Discovery
Attempt to gather information on host's network.
-
- Target e7069134552e53173e8d17c8e8e8cef312e3ca448134dfbd345fed37e739e075.exe
- Size 432KB
- SHA256 e7069134552e53173e8d17c8e8e8cef312e3ca448134dfbd345fed37e739e075
Score10/10-
Family: ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
- Target e7178a4bad4407316b85894307df32fdf85b597455364eb8ec4d407749e852ce.exe
- Size 141KB
- SHA256 e7178a4bad4407316b85894307df32fdf85b597455364eb8ec4d407749e852ce
Score10/10-
Family: TargetCompany,Mallox
TargetCompany (aka Mallox) is a ransomware which encrypts files using a combination of ChaCha20, AES-128, and Curve25519, first seen in June 2021.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (3804) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Stops running service(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29de364f.exe
- Size 71KB
- SHA256 e75717be1633b5e3602827dc3b5788ff691dd325b0eddd2d0d9ddcee29de364f
Score6/10-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
- Target e836a71f9df0e8f4f6b5920ec0a1e311cb8933d7cb9017e3c9fcfe46fd0468d9.exe
- Size 440KB
- SHA256 e836a71f9df0e8f4f6b5920ec0a1e311cb8933d7cb9017e3c9fcfe46fd0468d9
Score9/10-
Renames multiple (297) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Disables Task Manager via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry
-
- Target e840195cc07bb9739e0da2dcc7a4d94c0b075a06af69146ec2757bfcc7dace05.exe
- Size 182KB
- SHA256 e840195cc07bb9739e0da2dcc7a4d94c0b075a06af69146ec2757bfcc7dace05
Score10/10-
Family: Azov
A wiper seeking only damage, first seen in 2022.
-
Renames multiple (13361) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target e858c09b00ed06ba71a17f4791b6264ab9cfac3dcc9d61df10f9b2a1e7b072e4.exe
- Size 860KB
- SHA256 e858c09b00ed06ba71a17f4791b6264ab9cfac3dcc9d61df10f9b2a1e7b072e4
Score6/10-
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Windows Command Shell
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Debugger Evasion
1Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
3File Deletion
3Modify Registry
7Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Debugger Evasion
1Network Service Discovery
1Peripheral Device Discovery
2Query Registry
5Remote System Discovery
1System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
3Internet Connection Discovery
2