Skip to main content
MalwarePublished

RegretLocker · compiled information, activity and samples

Source CIRCL OSINT Feed

0

TLP:WHITE, disclosure is not limited

Description

RegretLocker is a ransomware family with compiled information, observed activity, and available samples documented. The data is based on open-source intelligence with moderate certainty. No specific technical details, affected versions, or active exploits are provided in this report.

Indicators of compromise

Domains 2

  • regretzjibibtcgb.onion
  • regretzjibibtcgb.onion

URLs 2

  • http://344744.cloud4box.ru/files/locker/locker.exeSource url
  • http://regretzjibibtcgb.onion/input

IP addresses 1

  • 109.248.203.209

Hashes 48

  • 1e4f92167c3ab2dc2c01650e939055f9
  • 4d18b6c125b4668ed00358c002c8a0dfae23db7a
  • 3ea51233fc585fcd6772cf677512cb9b06f8a6c971fd5c39b591a2a2d0357fee
  • 9627bc232692d7589b54d2b0ffc9bca17535bbb67e35da303e4ed9dd24a9a8dc8ea65f6d0bdc3d01cf5976aec2b306d56cecbb47d285e5bff7c108c678be622f
  • d4267ed23f4b852d028f443cb4aad133
  • e15c846060a20f089f14869bc16992023cd431b7
  • 3a64bac9f63b3a6aa3ee4e1ac7c038248dcf2283712c64f740866f0597008735
  • 82d142ba284bd9534032e830d4f56ad7a8162f6bfa49fd63985bbe9d80c560d3e9500ed13cab54506bc62d86a890fa0a88a9906e232da0b48bdda804752411d7
  • bdac7b3caf4a2640a848c52d56263d6f
  • 4074eac2c7cb8f54042d7753fddf79d41e6ba1da

Text 26

  • WIN-295748OMAKGThe malware writter has 2 weird checks to check for a particular user name and PC name(WIN-295748OMAKG). If the user name or the PC name matches, the malware will exit immediately.
  • http://regretzjibibtcgb.onion/input
  • regretzjibibtcgb.onion
  • http
  • RSA
  • -----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC1ZQInrnhxXCtAN/LsOX2GmgbvBxMsO49lc1/qodshkUvRQLazWv61UbMLKx2gaRQrCYuVrR1Cgd7LxY4ueGo50TqZioAJbCcfzdiXlEkJqLlz4RTU9RFZ/wFjWxChek2NsU6vLLSowPPTw+JhwTooI+QPAIYeoxCf4xz7Kvu9CQIDAQAB -----END PUBLIC KEY-----
  • malware-extraction
  • 3.7.1
  • all
  • .text

Windows scheduled task 1

Next, it also schedules the malware as a task every minite using this Schtasks.exe command, which is run from cmd.exe using ShellExecuteA.

  • Mouse Application

Yara 1

  • rule regretlocker { meta: description = "YARA rule for RegretLocker" reference = "http://chuongdong.com/reverse%20engineering/2020/11/17/RegretLocker/" author = "@cPeterr" tlp = "white" strings: $str1 = "tor-lib.dll" $str2 = "http://regretzjibibtcgb.onion/input" $str3 = ".mouse" $cmd1 = "taskkill /F /IM \\" $cmd2 = "wmic SHADOWCOPY DELETE" $cmd3 = "wbadmin DELETE SYSTEMSTATEBACKUP" $cmd4 = "bcdedit.exe / set{ default } bootstatuspolicy ignoreallfailures" $cmd5 = "bcdedit.exe / set{ default } recoveryenabled No" $func1 = "open_virtual_drive()" $func2 = "smb_scanner()" $checklarge = { 81 fe 00 00 40 06 } condition: all of ($str*) and any of ($cmd*) and any of ($func*) and $checklarge }

Size in bytes 12

  • 320000
  • 103936
  • 10752
  • 39424
  • 19456
  • 494592
  • 298496
  • 93696
  • 10240
  • 39424

Float 12

  • 6.6348495531091
  • 5.3139379645706
  • 4.5643514844553
  • 6.3888085830938
  • 6.6017444852914
  • 6.58346583069
  • 6.6475524649073
  • 5.4415893542669
  • 4.5555134237561
  • 6.3887459421453

Ssdeep 12

  • 6144:8rvDx+dR25Cb1GjTiRsKKs5wYfOXGr6ckXDjkiW5EEyyq8MeCt10zXzcVP:aF+dRkCGjzKd5Ik6ZDEyyq8Me0KzYP
  • 1536:pM9MP1i6fkKxs8jsdrPQF7X8HZ4XhgPCa7fksWPcdEvtmgMbFubmJXz9/7FbXuyf:pi6sLxZRFrXOAg0FubmJj97Fb+yNd
  • 192:uwiPy9D8pZIRxTRjRkRtRaN0NN0JbgcUC3h4+/1M:uwJ1IXu41
  • 768:lzC4MphX0qphDmlRUoPLs2IgHi3QcD2vZc22BGkiAi2:lzC4MpvhCRto5gCxyy22gAV
  • 192:UoXZpZ/peUCpKNaBksXNJzFL/0ztmARyzlHlndnKEs6FnKTKnbBwaSbEbw814lUP:tZUU8yGDDAwzlFdK96FcKHwLrFgx9fl
  • 12288:JF+dRkCGjzKd5Ik6ZDEyyq8Me0KzYB3IvClBTn:JF+deC2+d5AZLde0KcBU4BT
  • 6144:lf0ryFWUY6V0eU82Tvvase6Jqrm7mi+HH38rnb9Fn41+nVszCxoj58T9O4:lf0GWQ0TvvNdem7m9H0n41+nVs+x05Z4
  • 1536:QZL1M6liPlQtc/s8jsdVx6nwL4XhgvRsWAcd0vtmgMbFuzmxyttyN7:QBNYz6bLxFeAg0FuzmkbyN7
  • 96:AMPlvM5V16Ka4t6k7+x5WRwWRyN0NN0v3CxuOH6Ah8q+VOid:Dy6Ka4t6k7+xARjRyN0NN0v3sTH6Ag
  • 768:1zC4MphX0qphDmlRUoPLs2IgHi3QcD2vZc22BGkiAi2:1zC4MpvhCRto5gCxyy22gAV

Datetime 5

  • 2020-10-23T09:56:46+00:00
  • 2020-12-10T18:07:01+00:00
  • 2020-11-11T09:22:22+00:00
  • 2020-11-11T09:43:20+00:00
  • 2020-12-10T18:07:01+00:00

Counter 2

  • 5
  • 5

File 2

  • a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4
  • c5c7e4f126099586670346024bd37eccf0cce6dd1eb8cfcafbb24530e1c582fa

Malware sample 2

  • a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4|3265b2b0afc6d2ad0bdd55af8edb9b37
  • c5c7e4f126099586670346024bd37eccf0cce6dd1eb8cfcafbb24530e1c582fa|83153f8ca7f872a1b4abd40a5bd58094

Mime type 2

  • PE32 executable (GUI) Intel 80386, for MS Windows
  • PE32 executable (GUI) Intel 80386, for MS Windows

Community reviews

Loading reviews…