Overview

overview

10

Static

static

6

cd49c58def...2c.exe

windows7_x64

10

cd49c58def...2c.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.zip
  • Size 1014KB
  • Sample200917-esb8zrlkza
  • SHA256 9fdff0a10462045e31f33513b7cdbc43ff423709b7b6ac12555de40af498ffb6
  • MD5 SHA1 SHA512
Score
10/10
smaugransomwarespyware

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\HACKED.txt

  • smaug

Ransom Note
  • Your files have been encrypted using military grade encryption. They can never be accessed again without buying a decryption key. You can buy the decryption key at http://smaugrwmaystthfxp72tlmdbrzlwdp2pxtpvtzvhkv5ppg3difiwonad.onion. To access the site you need Tor Browser. Download tor browser here - https://www.torproject.org/download/ . Once you download enter url in tor browser. If you do not know how to buy bitcoin here are options-. https://www.coinbase.com/ , https://paxful.com/ , https://changelly.com/ , or locate a bitcoin ATM like https://www.bitcoindepot.com/ . If you dont buy decryption key or make threats then we will auction your data , passwords, documents, files, ip,router,company server details, along with decryption key via an darkweb auction to highest bidder.,We stay in business because we honor our word. upon payment All your data will remain confidential, and not leaked.
URLs

  • http://smaugrwmaystthfxp72tlmdbrzlwdp2pxtpvtzvhkv5ppg3difiwonad.onion

  • https://paxful.com/

  • https://changelly.com/

  • https://www.bitcoindepot.com/

Targets

    • Target
      cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe
    • Size 2.4MB
    • SHA256 cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c
    • MD5 SHA1 SHA512
    Score
    10/10
    ransomwarespywaresmaug

    • Smaug

      Ransomware-as-a-service first seen marketed on forums etc. in early 2020.

      ransomwaresmaug

    • Drops file in Drivers directory

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks