Genel Bakis
Bu ornek, kurumsal hedeflere yonelik NightSky Ransomware'in 9.7MB'lik PE32+ x64 ornegi. Cifte gasp (double extortion) modeli kullanan bu fidye yazilimi, veri calmadan once 107GB kurumsal veriyi exfil etmis ve akij@nightsky.cyou e-postasi ile xafcibeh2lvq5x7fx76ygcosad.onion adresi uzerinden iletisim kurmaktadir. Fidye notunda sohbet icin bir sifre bile gonderilmis: kdjfikerjijJHDUFIGjk3289.
NightSky Hakkinda
- 2021 sonu - 2022 basinda ortaya cikan kurumsal ransomware ailesi
- Log4Shell (CVE-2021-44228) zafiyeti uzerinden ilk erisim sagladigi raporlandi
- Cifte gasp: sifreleme + veri sizintisi tehdidi
- Hedef: orta ve buyuk olcekli kurumlar
Teknik Analiz
Gömülü Fidye Notu (HTML)
NightSkyReadMe.hta
Internal files have been stolen and encrypted by us.
we will decrypt the data and destroy the stolen data without data leakage.
Do not contact third party to restore the file, the file cannot be decrypted
without the key. The third party only contact us to buy the key at a lower
price to earn the difference.
Steal list:
All website Cpanel database backup 107GB
Contact: https://contact.nightsky.cyou
xafcibeh2lvq5x7fx76ygcosad.onion
Username and password to login to chat:
password: kdjfikerjijJHDUFIGjk3289Sifreleme ve C2
- RSA anahtar ciftleri gömülü:
-----BEGIN RSA PRIVATE KEY----- - Tor C2:
xafcibeh2lvq5x7fx76ygcosad.onion - Yuzey web iletisim:
https://contact.nightsky.cyou - E-posta:
akij@nightsky.cyou - Sohbet sifresi:
kdjfikerjijJHDUFIGjk3289
Teknik Ozellikler
| Ozellik | Valor |
|---|---|
| Format | PE32+ console x86-64 |
| Tamaño | 9.768.448 bayt (9.7MB) |
| Entropi | 7.82 (muhtemelen paketlenmis) |
| Section sayisi | 11 (yuksek) |
| Tor C2 | xafcibeh2lvq5x7fx76ygcosad.onion |
| Web | contact.nightsky.cyou |
| akij@nightsky.cyou | |
| Fidye Notu | NightSkyReadMe.hta |
| Cifte Gasp | 107GB veri sizintisi tehdidi |
IOC Ozeti
- Tor:
xafcibeh2lvq5x7fx76ygcosad.onion - Web:
contact.nightsky.cyou - Email:
akij@nightsky.cyou - Sifre:
kdjfikerjijJHDUFIGjk3289 - SHA256:
ff5757086c464d624f4a6674d65409fb6fa84ad5ac089583ebc994ba949458d7
Lista IOC (4 indicadores)
IOC — NightSky Ransomware
# SHA256
ff5757086c464d624f4a6674d65409fb6fa84ad5ac089583ebc994ba949458d7
# DOMAIN
xafcibeh2lvq5x7fx76ygcosad.onion
# DOMAIN
contact.nightsky.cyou
# EMAIL
akij@nightsky.cyou
| Tipo | Valor | Nota |
|---|---|---|
| sha256 | ff5757086c464d624f4a6674d65409fb6fa84ad5ac089583ebc994ba949458d7 | |
| domain | xafcibeh2lvq5x7fx76ygcosad.onion | |
| domain | contact.nightsky.cyou | |
| akij@nightsky.cyou |
Servidores C2 (1 servidores registrados para esta familia)
| Dirección | Tipo | Puerto | Protocolo | Estado | País |
|---|---|---|---|---|---|
| xafcibeh2lvq5x7fx76ygcosad.onion | domain | 80 | HTTP | inactive | — |
Las direcciones C2 se proporcionan únicamente a partir de muestras de malware verificadas manualmente por el equipo KEYDAL. Se prohíbe el uso comercial.