Overview

overview

10

Static

static

ransomware

windows7_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    client.exe
  • Size 61KB
  • Sample200512-e1ctv8a86n
  • SHA256 f0c0c989b018ee24cbd7548cec4e345fd34f491d350983fddb5ddc1ad1f4ba9f
  • MD5 SHA1 SHA512
Score
10/10
hakbitpersistenceransomwarespyware

Malware Config

Extracted

Path

  • C:\Users\Admin\Desktop\HELP_ME_RECOVER_MY_FILES.txt

  • hakbit

Ransom Note
  • !!! WARNING !!! WARNING !!! WARNING !!! Where are my files? We have them safely cyphered. You want them back? Contact: [email protected] Telegram Messenger : @CRYPTOMAB Key Identifier: BWmVcy4HiLlA42hfFL4WyIgHzYq76MCNXrjvKMDE3Pjbz1UfszKSjghUXMbOtRzv86zZfPzDL5EMabfvLZEHCNnTC3eVpTEMYg0h5PLjrrKjjmM9Rgt/fvQTLN8UbVNz+vPsCIZ7JzVoyow0cFQHSova4Gia+i1BOrBc7M7MSttYN1L5IKNqDDz0GoaQ28gFCMGduC2nAef9uJIaYEt/ewU/yOP5WWyGZuYYSmBH2OyeBw5rM347VBPYi0rE/Mw32BX36Pm7gRH3R5HBDNcxnwMIeX+aD77YhtT4KjcsLnZ1W7XDBO7V0mBxUSAp7cPUJo5oljUcasYveMBA2NuJlQ== Number of files that you could have potentially lost forever can be as high as: 70
Emails

Targets

    • Target
      client.exe
    • Size 61KB
    • SHA256 f0c0c989b018ee24cbd7548cec4e345fd34f491d350983fddb5ddc1ad1f4ba9f
    • MD5 SHA1 SHA512
    Score
    10/10
    ransomwarepersistencespywarehakbit

    • Hakbit

      Ransomware which encrypts files using AES, first seen in November 2019.

      ransomwarehakbit

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Modifies service

      persistence
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks