General

  • Target

    7f6dbd9fa0cb7ba2487464c824b6d7e16ace9d4cd15e4452df4c9a9fd6bd1907

  • Size

    175KB

  • Sample

    220411-tb7fysahe5

  • MD5

    f746ea39c0c5ff9d0a1f2d250170ad80

  • SHA1

    dac28369f5a4436b2556f9b4f875e78d5c233edb

  • SHA256

    7f6dbd9fa0cb7ba2487464c824b6d7e16ace9d4cd15e4452df4c9a9fd6bd1907

  • SHA512

    dffb4eaa4119df790eb6b85ae341ee2ba4438d7983d0023320f19a4f2df201a3fc3d4d3cc4f1a67c6d1cad4809ac1b914bdad584da7df1b500354386f07fbc30

Malware Config

Extracted

Path

C:\R3ADM3.txt

Ransom Note
_ ______ ____ _____ | \ | || ___ \/ ___|| ___| | \| || |_/ / /___ |___ \ | . ` || ___ \ ___ \ \ \ | |\ || |_/ / \_/ |/\__/ / \_| \_/\____/\_____/\____/ By now it's probably painfully apparent that your environment has been infected with ransomware. You can thank Conti for that. We've modified the code in a way that will prevent you from decrypting it with their decryptor. We've exfiltrated a significant amount of data including private emails, financial information, contacts, etc. Now, if you wish to contact us in order to save your files from permanent encryption you can do so by emailing network_battalion_0065@riseup.net. You have 3 days to establish contact. Failing to do so will result in that data remaining permenantly encrypted. While we have very little sympathy for the situation you find yourselves in right now, we will honor our agreement to restore your files across the affected environment once contact is established and payment is made. Until that time we will take no action. Be aware that we have compromised your entire network. We're watching very closely. Your President should not have commited war crimes. If you're searching for someone to blame for your current situation look no further than Vladimir Putin.
Emails

network_battalion_0065@riseup.net

Targets

    • Target

      7f6dbd9fa0cb7ba2487464c824b6d7e16ace9d4cd15e4452df4c9a9fd6bd1907

    • Size

      175KB

    • MD5

      f746ea39c0c5ff9d0a1f2d250170ad80

    • SHA1

      dac28369f5a4436b2556f9b4f875e78d5c233edb

    • SHA256

      7f6dbd9fa0cb7ba2487464c824b6d7e16ace9d4cd15e4452df4c9a9fd6bd1907

    • SHA512

      dffb4eaa4119df790eb6b85ae341ee2ba4438d7983d0023320f19a4f2df201a3fc3d4d3cc4f1a67c6d1cad4809ac1b914bdad584da7df1b500354386f07fbc30

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Tasks