Genel Bakis

Bu ornek, kurumsal hedeflere yonelik NightSky Ransomware'in 9.7MB'lik PE32+ x64 ornegi. Cifte gasp (double extortion) modeli kullanan bu fidye yazilimi, veri calmadan once 107GB kurumsal veriyi exfil etmis ve akij@nightsky.cyou e-postasi ile xafcibeh2lvq5x7fx76ygcosad.onion adresi uzerinden iletisim kurmaktadir. Fidye notunda sohbet icin bir sifre bile gonderilmis: kdjfikerjijJHDUFIGjk3289.

NightSky Hakkinda

  • 2021 sonu - 2022 basinda ortaya cikan kurumsal ransomware ailesi
  • Log4Shell (CVE-2021-44228) zafiyeti uzerinden ilk erisim sagladigi raporlandi
  • Cifte gasp: sifreleme + veri sizintisi tehdidi
  • Hedef: orta ve buyuk olcekli kurumlar

Teknik Analiz

Gömülü Fidye Notu (HTML)

NightSkyReadMe.hta

Internal files have been stolen and encrypted by us.

we will decrypt the data and destroy the stolen data without data leakage.

Do not contact third party to restore the file, the file cannot be decrypted
without the key. The third party only contact us to buy the key at a lower
price to earn the difference.

Steal list:
  All website Cpanel database backup  107GB

Contact: https://contact.nightsky.cyou
         xafcibeh2lvq5x7fx76ygcosad.onion

Username and password to login to chat:
  password: kdjfikerjijJHDUFIGjk3289

Sifreleme ve C2

  • RSA anahtar ciftleri gömülü: -----BEGIN RSA PRIVATE KEY-----
  • Tor C2: xafcibeh2lvq5x7fx76ygcosad.onion
  • Yuzey web iletisim: https://contact.nightsky.cyou
  • E-posta: akij@nightsky.cyou
  • Sohbet sifresi: kdjfikerjijJHDUFIGjk3289

Teknik Ozellikler

OzellikЗначение
FormatPE32+ console x86-64
Размер9.768.448 bayt (9.7MB)
Entropi7.82 (muhtemelen paketlenmis)
Section sayisi11 (yuksek)
Tor C2xafcibeh2lvq5x7fx76ygcosad.onion
Webcontact.nightsky.cyou
Emailakij@nightsky.cyou
Fidye NotuNightSkyReadMe.hta
Cifte Gasp107GB veri sizintisi tehdidi

IOC Ozeti

  • Tor: xafcibeh2lvq5x7fx76ygcosad.onion
  • Web: contact.nightsky.cyou
  • Email: akij@nightsky.cyou
  • Sifre: kdjfikerjijJHDUFIGjk3289
  • SHA256: ff5757086c464d624f4a6674d65409fb6fa84ad5ac089583ebc994ba949458d7

Список IOC (4 индикаторов)

IOC — NightSky Ransomware
# SHA256 ff5757086c464d624f4a6674d65409fb6fa84ad5ac089583ebc994ba949458d7 # DOMAIN xafcibeh2lvq5x7fx76ygcosad.onion # DOMAIN contact.nightsky.cyou # EMAIL akij@nightsky.cyou
ТипЗначениеПримечание
sha256 ff5757086c464d624f4a6674d65409fb6fa84ad5ac089583ebc994ba949458d7
domain xafcibeh2lvq5x7fx76ygcosad.onion
domain contact.nightsky.cyou
email akij@nightsky.cyou

C2 Серверы (1 зарегистрированных серверов для этого семейства)

Адрес Тип Порт Протокол Статус Страна
xafcibeh2lvq5x7fx76ygcosad.onion domain 80 HTTP inactive —

Адреса C2 предоставляются только на основе образцов вредоносного ПО, вручную проверенных командой KEYDAL. Коммерческое использование запрещено.

Теги
nightskyransomwaredouble-extortiontoronionrsacorporatelog4shellhtahtmlcifte-gaspkurumsal