Description Summary
According to OALabs, this ransomware has the following features: * Files are encrypted with AES CBC using a generated 256 bit key and IV. * The generated AES keys are encrypted using a hard coded RSA key and appended to the encrypted files.
Threat Actor
RaaS; .NET payload obfuscated with .NET Reactor.
Technical Indicators
Encryption Extension
.<random 5-char>
Encryption Algorithm
AES-256 (CBC) + RSA (hardcoded public key)
Ransom Note Name
RESTORE-FILES-[ext].txt
Targeted Industries
Cross-sector
First Seen
April 2023
Last Seen
Active
Geographical Location
Worldwide
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |