General

  • Target

    2024-06-27_9d321df9405cb926068b683c6523ea33_darkside

  • Size

    152KB

  • Sample

    240627-pyj7qasbkb

  • MD5

    9d321df9405cb926068b683c6523ea33

  • SHA1

    d97e101eb8cad867de03bce0034a8a3792924360

  • SHA256

    12474618f58fb808fe514e68e7e686185a9d512e469463f331bcde823e997596

  • SHA512

    ac45f36a2f2107ebae5974bad12eacb5d4a65ed0d116d1a8d677a1d305e76d5bfebf4af006c75b2186eeb000c91201c04877a536b01215307a3be3ac2af110b7

  • SSDEEP

    3072:j6glyuxE4GsUPnliByocWepwiFD78XS9hkEfYL:j6gDBGpvEByocWeyi6XS9hX

Malware Config

Extracted

Path

C:\FSx0EaYuE.README.txt

Ransom Note
RADAR and DISPOSSESSOR TEAM Your network has been breached and all major data were encrypted. Important files have been downloaded from your servers and are ready to be published on Data Leak blogs, DarkWeb forums, Telegram channels etc. To decrypt all the data and prevent exfiltrated corporate/confidential files from your companies network to be disclosed, you should contact with us. We will provide you a proof video how our RADAR Decryption Tool works. Please contact our sales department by “Contact Us” form: https://radar.ltd/contact-us Or via TOR Browser: http://e27z5kd2rjsern2gpgukhcioysqlfquxgf7rxpvcwepxl4lfc736piyd.onion/contact-us How to open any .onion website? - For Windows, Mac, and Linux users, you can directly download the Tor Browser from the Official Tor Project website - https://www.torproject.org/download/ then install it on your system. Official guide - https://tb-manual.torproject.org/installation/ What are onion sites? Onion sites are websites on the dark web that use the “.onion” top-level domain instead of “.com,” “.net,” “.gov,” etc. Onion sites use The Onion Router (Tor) software to encrypt their connections and enable anonymous communication. Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete encrypted files. In result your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything and your data, recorded data on videos etc will be published. - Do not hire a recovery company. They can't decrypt files without our Decryption Tool. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail and in result affected company should close their business because of them. You should contact with us yourself and we'll guarantee you 1008F9B97D9B6190041DF806A444D975BF7uccessful decryption with video proofs without any loss + exfiltrated data erasing from our servers. - Do not reject to purchase RADAR Decryptor from us, otherwise exfiltrated files will be publicly disclosed with video of all files. If you will refuse to pay as you should know, that we have direct contact with a list of journalists, law firms and even videosharing company with a website https://cybertube.video , cybernews company https://cybernewsint.com where the news will be published and a list of leak blogs with millions of visitors, where your files will be posted. The next step will be the callings and mailing to contact list of news sites, law firms, your customers and partners with a link to the video, leak blog, news etc In result you may suffer significant problems due disastrous consequences, leading to loss of valuable intellectual property and other sensitive information, GDPR issues, costly incident response efforts, information misuse/abuse, loss of customer trust, brand and reputational damage, legal and regulatory issues. Don't try to hide the situation, it's impossible with us, since our team is professionals with 14 years of experience in cybersecurity area. Our interest is not to harm your company, but to help improve security and we can do this for you. FAQ - https://notebin.de/?c75427561d17979e#33HX7GzVDGy35o1CuEv8qokJNibnANUbe2CAM9CLjc9L News about us - https://socradar.io/dark-web-profile-dispossessor-ransomware/ https://x.com/ransomfeednews/status/1793647035888840759 P.S. Do not repeat the same mistakes as other companies did with us, for example our old case with a small Spain Company: ALVAC S.A. Their Website - https://alvac.es Our media team published files and videos, because they didn't pay as in time. Small part of proofs: https://vimeo.com/752214614 https://hacknotice.com/2022/10/01/alvac-sa/ https://twitter.com/elhackernet/status/1576678217603502080 https://twitter.com/search?q=alvacvimeo&src=typed_query&f=live Lot of telegram channels like https://t.me/elconfidencial , https://t.me/baseleak and all darkweb resources listed here - https://github.com/fastfire/deepdarkCTI/blob/main/telegram.md For ALVAC SA we hired 3rd party team of data analysts with OSINT-specialists. Because of adding such 3rd parties, the price for Decryption Tool and exfiltrated data erasing has been increased. In result they suffered significant problems due disastrous consequences, leading to loss of valuable intellectual property and other sensitive information, GDPR issues, costly incident response efforts, information misuse/abuse, loss of customer trust, brand and reputational damage, legal and regulatory issues. And it will never end for them, as their files are constantly downloaded and videos are viewed by people from all over the World. That's why we don't recommend to ignore us. Let's respect each others time. With best Regards, RADAR and DISPOSSESSOR TEAM
URLs

https://radar.ltd/contact-us

http://e27z5kd2rjsern2gpgukhcioysqlfquxgf7rxpvcwepxl4lfc736piyd.onion/contact-us

https://cybertube.video

https://cybernewsint.com

https://notebin.de/?c75427561d17979e#33HX7GzVDGy35o1CuEv8qokJNibnANUbe2CAM9CLjc9L

https://socradar.io/dark-web-profile-dispossessor-ransomware/

https://x.com/ransomfeednews/status/1793647035888840759

https://alvac.es

https://vimeo.com/752214614

https://hacknotice.com/2022/10/01/alvac-sa/

https://twitter.com/elhackernet/status/1576678217603502080

https://twitter.com/search?q=alvacvimeo&src=typed_query&f=live

https://t.me/elconfidencial

https://t.me/baseleak

https://github.com/fastfire/deepdarkCTI/blob/main/telegram.md

Extracted

Path

C:\FSx0EaYuE.README.txt

Ransom Note
RADAR and DISPOSSESSOR TEAM Your network has been breached and all major data were encrypted. Important files have been downloaded from your servers and are ready to be published on Data Leak blogs, DarkWeb forums, Telegram channels etc. To decrypt all the data and prevent exfiltrated corporate/confidential files from your companies network to be disclosed, you should contact with us. We will provide you a proof video how our RADAR Decryption Tool works. Please contact our sales department by “Contact Us” form: https://radar.ltd/contact-us Or via TOR Browser: http://e27z5kd2rjsern2gpgukhcioysqlfquxgf7rxpvcwepxl4lfc736piyd.onion/contact-us How to open any .onion website? - For Windows, Mac, and Linux users, you can directly download the Tor Browser from the Official Tor Project website - https://www.torproject.org/download/ then install it on your system. Official guide - https://tb-manual.torproject.org/installation/ What are onion sites? Onion sites are websites on the dark web that use the “.onion” top-level domain instead of “.com,” “.net,” “.gov,” etc. Onion sites use The Onion Router (Tor) software to encrypt their connections and enable anonymous communication. Follow the guidelines below to avoid losing your data: - Do not modify, rename or delete encrypted files. In result your data will be undecryptable. - Do not modify or rename encrypted files. You will lose them. - Do not report to the Police, FBI, etc. They don't care about your business. They simply won't allow you to pay. As a result you will lose everything and your data, recorded data on videos etc will be published. - Do not hire a recovery company. They can't decrypt files without our Decryption Tool. They also don't care about your business. They believe that they are good negotiators, but it is not. They usually fail and in result affected company should close their business because of them. You should contact with us yourself and we'll guarantee you 1008F9B97D9B619004168A31E1E3AAB625Fuccessful decryption with video proofs without any loss + exfiltrated data erasing from our servers. - Do not reject to purchase RADAR Decryptor from us, otherwise exfiltrated files will be publicly disclosed with video of all files. If you will refuse to pay as you should know, that we have direct contact with a list of journalists, law firms and even videosharing company with a website https://cybertube.video , cybernews company https://cybernewsint.com where the news will be published and a list of leak blogs with millions of visitors, where your files will be posted. The next step will be the callings and mailing to contact list of news sites, law firms, your customers and partners with a link to the video, leak blog, news etc In result you may suffer significant problems due disastrous consequences, leading to loss of valuable intellectual property and other sensitive information, GDPR issues, costly incident response efforts, information misuse/abuse, loss of customer trust, brand and reputational damage, legal and regulatory issues. Don't try to hide the situation, it's impossible with us, since our team is professionals with 14 years of experience in cybersecurity area. Our interest is not to harm your company, but to help improve security and we can do this for you. FAQ - https://notebin.de/?c75427561d17979e#33HX7GzVDGy35o1CuEv8qokJNibnANUbe2CAM9CLjc9L News about us - https://socradar.io/dark-web-profile-dispossessor-ransomware/ https://x.com/ransomfeednews/status/1793647035888840759 P.S. Do not repeat the same mistakes as other companies did with us, for example our old case with a small Spain Company: ALVAC S.A. Their Website - https://alvac.es Our media team published files and videos, because they didn't pay as in time. Small part of proofs: https://vimeo.com/752214614 https://hacknotice.com/2022/10/01/alvac-sa/ https://twitter.com/elhackernet/status/1576678217603502080 https://twitter.com/search?q=alvacvimeo&src=typed_query&f=live Lot of telegram channels like https://t.me/elconfidencial , https://t.me/baseleak and all darkweb resources listed here - https://github.com/fastfire/deepdarkCTI/blob/main/telegram.md For ALVAC SA we hired 3rd party team of data analysts with OSINT-specialists. Because of adding such 3rd parties, the price for Decryption Tool and exfiltrated data erasing has been increased. In result they suffered significant problems due disastrous consequences, leading to loss of valuable intellectual property and other sensitive information, GDPR issues, costly incident response efforts, information misuse/abuse, loss of customer trust, brand and reputational damage, legal and regulatory issues. And it will never end for them, as their files are constantly downloaded and videos are viewed by people from all over the World. That's why we don't recommend to ignore us. Let's respect each others time. With best Regards, RADAR and DISPOSSESSOR TEAM
URLs

https://radar.ltd/contact-us

http://e27z5kd2rjsern2gpgukhcioysqlfquxgf7rxpvcwepxl4lfc736piyd.onion/contact-us

https://cybertube.video

https://cybernewsint.com

https://notebin.de/?c75427561d17979e#33HX7GzVDGy35o1CuEv8qokJNibnANUbe2CAM9CLjc9L

https://socradar.io/dark-web-profile-dispossessor-ransomware/

https://x.com/ransomfeednews/status/1793647035888840759

https://alvac.es

https://vimeo.com/752214614

https://hacknotice.com/2022/10/01/alvac-sa/

https://twitter.com/elhackernet/status/1576678217603502080

https://twitter.com/search?q=alvacvimeo&src=typed_query&f=live

https://t.me/elconfidencial

https://t.me/baseleak

https://github.com/fastfire/deepdarkCTI/blob/main/telegram.md

Targets

    • Target

      2024-06-27_9d321df9405cb926068b683c6523ea33_darkside

    • Size

      152KB

    • MD5

      9d321df9405cb926068b683c6523ea33

    • SHA1

      d97e101eb8cad867de03bce0034a8a3792924360

    • SHA256

      12474618f58fb808fe514e68e7e686185a9d512e469463f331bcde823e997596

    • SHA512

      ac45f36a2f2107ebae5974bad12eacb5d4a65ed0d116d1a8d677a1d305e76d5bfebf4af006c75b2186eeb000c91201c04877a536b01215307a3be3ac2af110b7

    • SSDEEP

      3072:j6glyuxE4GsUPnliByocWepwiFD78XS9hkEfYL:j6gDBGpvEByocWeyi6XS9hX

    • Renames multiple (362) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Collection

Data from Local System

1
T1005

Impact

Defacement

1
T1491

Tasks