Overview

overview

10

Static

static

Frog_Standard_Test

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Corporate_Detail-June.2020.exe
  • Size 1.3MB
  • Sample200813-xm6rn3yqv2
  • SHA256 f2363a355fe226cb2f7f1afa72daecc5edfe1cb0edc1295856fb3f874d941b6d
  • MD5 SHA1 SHA512
Score
10/10
smaugransomwarespyware

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\HACKED.txt

  • smaug

Ransom Note
  • Your files have been encrypted using military grade encryption. They can never be accessed again without buying a decryption key. You can buy the decryption key at http://smaugrwmaystthfxp72tlmdbrzlwdp2pxtpvtzvhkv5ppg3difiwonad.onion. To access the site you need Tor Browser. to view site you can download torbrowser here - https://www.torproject.org/download/ need help?support [email protected]
URLs

  • http://smaugrwmaystthfxp72tlmdbrzlwdp2pxtpvtzvhkv5ppg3difiwonad.onion

Targets

    • Target
      Corporate_Detail-June.2020.exe
    • Size 1.3MB
    • SHA256 f2363a355fe226cb2f7f1afa72daecc5edfe1cb0edc1295856fb3f874d941b6d
    • MD5 SHA1 SHA512
    Score
    10/10
    ransomwaresmaugspyware

    • Smaug

      Ransomware-as-a-service first seen marketed on forums etc. in early 2020.

      ransomwaresmaug

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • JavaScript code in executable

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks