suporte01928492.redirectme.net

atualziarsys.serveirc.com

suporte01092021.myftp.biz

suportmicrowin.sytes.net

retrievedata300@gmail.com

setup.exe

bat.rar

reg.rar

update.exe

update.bat

mylink.vbs

windowsupdate2.rar

favicon.ico

1.exe

e10713a4a5f635767dcd54d609bed977

e1c449aa607f70a9677fe23822204817d0ff41ed3047d951d4f34fc9c502f761

106118444e0a7405c13531f8cd70191f36356581d58789dfc5df3da7ba0f9223

c3776649d9c0006caba5e654fa26d3f2c603e14463443ad4a5a08e4cf6a81994

c8d97269690d3b043fd6a47725a61c00b57e3ad8511430a0c6254f32d05f76d6

98a3ef26b346c4f47e5dfdba4e3e26d1ef6a4f15969f83272b918f53d456d099

a8d7b402e78721443d268b682f8c8313e69be945b12fd71e2f795ac0bcadb353

d6c35e23b90a7720bbe9609fe3c42b67d198bf8426a247cd3bb41d22d2de6a1f

24.152.38.205

54.38.122.66

149.56.38.170

66.70.170.191

142.44.129.70

46.105.36.189

54.39.193.37

144.217.139.134

51.38.19.201

51.222.53.150

87.98.137.173

24.152.37.19

198.50.246.8

54.39.84.55

46.105.38.67

51.79.63.229

164.132.77.246

149.56.113.76

24.152.36.210

176.31.37.237

24.152.37.8

24.152.36.117

51.79.107.134

51.222.173.152

51.79.107.242

144.217.117.172

54.39.152.91

142.44.146.178

51.79.44.57

24.152.36.46

51.79.44.59

24.152.36.35

144.217.17.186

24.152.36.158

51.38.19.200

144.217.111.5

87.98.171.7

66.70.148.142

66.70.209.168

24.152.36.98

144.217.117.10

66.70.148.136

54.39.137.73

54.36.146.230

54.39.84.52

24.152.36.150

54.39.163.57

149.56.68.191

158.69.99.10

54.39.247.244

158.69.99.15

149.56.147.205

54.39.84.53

144.217.233.98

24.152.36.195

144.217.139.13

198.50.246.14

24.152.36.176

51.161.76.196

66.70.209.170

51.222.97.189

144.217.17.185

144.217.45.67

144.217.45.64

198.27.105.3

198.50.204.38

51.161.76.197

91.134.217.71

144.217.32.26

54.36.82.188

66.70.209.171

54.39.8.92

54.39.247.228

24.152.36.104

54.39.152.202

24.152.36.25

178.32.243.48

66.70.173.72

54.38.225.81

24.152.37.189

198.50.246.15

51.79.105.91

51.222.173.151

51.222.173.142

149.56.85.98

144.217.158.195

192.95.20.74

T1189

T1059.007

T1083

T1012

T1056.001

T1571

T1486

T1027

T1543.003

c:\users\workdreams\desktop\test\nopyfy-ransomware-master\nopyfy-ransomware\nopyfy-ransomware\obj\debug\nopyfy-ransomware.pdb

http://services5500.sytes.net/update6/update.exe.rar

http://atualziarsys.serveirc.com/update4/update.exe.rar

http://suporte01928492.redirectme.net

http://services5500.sytes.net/update8/update.exe.rar

http://suporte20082021.sytes.net/update5/update.exe.rar

http://suporte01928492.redirectme.net/update5/update.exe.rar

http://services5500.sytes.net/update8/update.bat.rar

http://suporte01928492.redirectme.net/update7/update.bat.rar

http://suporte01092021.myftp.biz

http://suporte01928492.redirectme.net/update6/update.exe.rar

http://atualziarsys.serveirc.com/update3/update.reg.rar

http://suporte01928492.redirectme.net/update7

http://atualziarsys.serveirc.com/update3/mylink.vbs.rar

http://suporte20082021.sytes.net

http://atualziarsys.serveirc.com/update4/update.exe2.rar

http://suporte01092021.myftp.biz/update/windowsupdate2.rar

http://suporte01092021.myftp.biz/update5/update.exe.rar

http://suporte20082021.sytes.net/update/windowsupdate2.rar

http://atualziarsys.serveirc.com/favicon.ico

http://24.152.38.205/1.exe

http://appmonitorplugin.sytes.net

http://suportmicrowin.sytes.net/appmonitorplugin.rar

http://24.152.38.205/pt/setup.zip

rule CRIME_Exfiltration_Tool_Oct2021 {
	meta:
		description = "Rule to detect tool used to exfiltrate data from victim systems"
		author = "TS @ McAfee Enterprise ATR"
		date = "2021-10-04"
		hash = "ceb0e01d96f87af0e9b61955792139f8672cf788d506c71da968ca172ebddccd"
	strings:
		$pattern1 = { 79 FA 44 2F 5F B1 40 69 5D 7E D6 FC 6A 61 F3 D5 2F 37 F2 4B 2F 45 49 60 F5 D4 81 0C 05 D7 A8 3D 4D D8 E6 11 8A BD E2 05 5E 4D CC FE 28 EB A2 A1 1E 98 1D B4 03 C5 A4 7E FB 6E 36 7C 7E C4 8C 5E C2 99 99 76 B5 BC 80 F2 5B EF 5D 27 03 A1 E4 C2 E3 B3 0C D2 6E 92 57 0D AF 1F 9B D7 B4 8B 38 FB 52 23 58 }
		$pattern2 = { B4 A6 D4 DD 1B BE A1 64 73 94 0F C2 DA 10 3C D6 45 79 DD 1A 7E BD F3 06 38 A5 9E 54 7B 13 6E 5A D1 13 83 5B 82 94 F5 3B 8C 3A 43 5E B2 A7 F6 49 A3 83 AA 07 92 DD 14 B9 C2 6C 1B CA 34 89 20 DF D3 7D A3 EF 62 60 C5 7C 54 6C A5 19 25 F6 84 E9 12 39 15 2D C0 5D 51 61 A9 06 44 34 }
		$pattern3 = { 26 2E 47 6A 45 A1 4D 4A FA 44 8A F8 18 94 45 9F 72 96 63 36 44 F5 FD 06 1A 64 7C 6E F1 BA 95 0F F1 ED 48 43 6D 1B D4 97 6B F8 1E E8 4A E0 9D 63 8B D2 C2 A0 1F A9 E2 2D 20 15 51 82 80 F6 69 2E B9 76 87 6C 40 45 FA DB 71 74 2B 95 79 C1 3C 74 82 A4 4A }
		$pattern4 = { F2 A1 13 71 3C CB 04 9A FE 35 2D B8 F9 91 60 85 51 25 E5 A0 45 C9 F6 AC 0D CA 0A B6 15 BD 34 36 7F 2C A5 15 6D CE 5C A2 86 CC C5 5E 37 DF CD C5 AA D1 4E D9 DA B3 CD B9 D1 5B A9 1D D7 9F F9 6E 94 58 8F 30 }
	condition:
		3 of ($pattern*)
}