General

  • Target

    56b483bc7bf3708d49c6d326dc36e3b350aa431028ea05e7f1e7fd63177fb19c.exe

  • Size

    206KB

  • Sample

    200621-1sp71ylcqe

  • MD5

    7df850b43f3f28a67b8160c4265bc726

  • SHA1

    522377eced5e1694d36e45da75037d87e84b3729

  • SHA256

    56b483bc7bf3708d49c6d326dc36e3b350aa431028ea05e7f1e7fd63177fb19c

  • SHA512

    c6bb2271a794da8a7b5ac6f7e634f1d4173dbaa54fbc778dd29651fc99a5096b974f3bdd0c28775392760f8253bdb55ff7303a33915525ccd0d6a4f52d526225

Score
10/10

Malware Config

Extracted

Path

\??\c:\GOMER-README.txt

Ransom Note
! ATTENTION ! -------------------------------------------------------------------------------------------- ! STRICTLY FORBIDDEN TO USE THIRD-PARTY DECRYPTION SOFTWARE - FILES WILL BE LOST ! -------------------------------------------------------------------------------------------- Due vulnerability in your system all files have been protected with strong private key to safe them from unathorized access. To RESTORE your files, follow this instructions: 1. Gomer service charges a payment for file decryption tool 2. Contact us with attached Gomer-readme.txt 3. Receive Gomer file decryption tool 4. Run the tool and successfully RESTORE all your files! We guarantee: 100% Successful restoring all of your files 100% Satisfaction guarantee 100% Fast and secure service As a proof of our trusted service, you can send us 1 file and get it decrypted for free! -------------------------------------------------------------------------------------------- ! ONLY ORIGINAL GOMER DECRYPTION TOOL CAN RESTORE YOUR FILES ! -------------------------------------------------------------------------------------------- Contacts: support-gomer@pm.me Payments accepted: Bitcoin (BTC) ID KEY: gMWCXd52gagzYTakkupc2dqCy0xNvLiodz+1yw8fJ714F8MXpsFOM/mp6oqJJjLs 3bdTk/VPXtQ0vRVZtvF9w9a+zdn0UdgS3Axw18epdH0qaNxNmTh9BxOLts02C08b 1qWCyoq09LluA2HJi4Y8UPWDM2Rj4iCRVHWqHoM8HEQ= ~ GOMER ~ fZMyUwYEw1gbCXY2/a/Mzg==
Emails

support-gomer@pm.me

Extracted

Path

\??\c:\GOMER-README.txt

Ransom Note
! ATTENTION ! -------------------------------------------------------------------------------------------- ! STRICTLY FORBIDDEN TO USE THIRD-PARTY DECRYPTION SOFTWARE - FILES WILL BE LOST ! -------------------------------------------------------------------------------------------- Due vulnerability in your system all files have been protected with strong private key to safe them from unathorized access. To RESTORE your files, follow this instructions: 1. Gomer service charges a payment for file decryption tool 2. Contact us with attached Gomer-readme.txt 3. Receive Gomer file decryption tool 4. Run the tool and successfully RESTORE all your files! We guarantee: 100% Successful restoring all of your files 100% Satisfaction guarantee 100% Fast and secure service As a proof of our trusted service, you can send us 1 file and get it decrypted for free! -------------------------------------------------------------------------------------------- ! ONLY ORIGINAL GOMER DECRYPTION TOOL CAN RESTORE YOUR FILES ! -------------------------------------------------------------------------------------------- Contacts: support-gomer@pm.me Payments accepted: Bitcoin (BTC) ID KEY: Mv3RUPxA6TZHn7KyHUB8KVFt9yRJC2oYK6eaHoaoBgjNxWSLejVonVc53ILwv32V R6kWKpBdEL02Mt2tKQJjYayelxo92qSkqMTyvI+VdBYcmHY9ZeugaKaYy3VDJUNf z1P7VISk75+l/XTTIMXiWKX0TR25ZRx5T5hb3L2duzc= ~ GOMER ~ 8fXme2nyNr0CHdqGO3R4EQ==
Emails

support-gomer@pm.me

Targets

    • Target

      56b483bc7bf3708d49c6d326dc36e3b350aa431028ea05e7f1e7fd63177fb19c.exe

    • Size

      206KB

    • MD5

      7df850b43f3f28a67b8160c4265bc726

    • SHA1

      522377eced5e1694d36e45da75037d87e84b3729

    • SHA256

      56b483bc7bf3708d49c6d326dc36e3b350aa431028ea05e7f1e7fd63177fb19c

    • SHA512

      c6bb2271a794da8a7b5ac6f7e634f1d4173dbaa54fbc778dd29651fc99a5096b974f3bdd0c28775392760f8253bdb55ff7303a33915525ccd0d6a4f52d526225

    Score
    10/10
    • Deletes itself

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Remote System Discovery

1
T1018

Tasks