Overview

overview

10

Static

static

6

cd49c58def...2c.exe

windows7_x64

10

cd49c58def...2c.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.zip

  • Size

    1014KB

  • Sample

    200917-esb8zrlkza

  • MD5

    a0b07cf5d38703f6ae96afb8e2d10ae4

  • SHA1

    729c0cdef11f120bbd58c8ce5123151a0be7ead5

  • SHA256

    9fdff0a10462045e31f33513b7cdbc43ff423709b7b6ac12555de40af498ffb6

  • SHA512

    286a08fef15025a0d34a270679849fbe2c4c560b3dde994539b4404b102efbb0a8c01b3ec8fa4b4e92d4181696d7eb0bc8969bca059a37a0e085ed27aa109d73

Score
10/10
smaugransomwarespyware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\HACKED.txt

Family

smaug

Ransom Note
Your files have been encrypted using military grade encryption. They can never be accessed again without buying a decryption key. You can buy the decryption key at http://smaugrwmaystthfxp72tlmdbrzlwdp2pxtpvtzvhkv5ppg3difiwonad.onion. To access the site you need Tor Browser. Download tor browser here - https://www.torproject.org/download/ . Once you download enter url in tor browser. If you do not know how to buy bitcoin here are options-. https://www.coinbase.com/ , https://paxful.com/ , https://changelly.com/ , or locate a bitcoin ATM like https://www.bitcoindepot.com/ . If you dont buy decryption key or make threats then we will auction your data , passwords, documents, files, ip,router,company server details, along with decryption key via an darkweb auction to highest bidder.,We stay in business because we honor our word. upon payment All your data will remain confidential, and not leaked.
URLs

http://smaugrwmaystthfxp72tlmdbrzlwdp2pxtpvtzvhkv5ppg3difiwonad.onion

https://paxful.com/

https://changelly.com/

https://www.bitcoindepot.com/

Targets

    • Target

      cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe

    • Size

      2.4MB

    • MD5

      a239735cddd49236ae3562d43d83a8e4

    • SHA1

      35bad8d66c79af9dabdcdd8dcebfc0440efc42a1

    • SHA256

      cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c

    • SHA512

      34bbfc20d82c4227f9e745f0f7cdb5ce68c684a4a84cde0340fa82601f9340fcb7d21c6060564be8580dcba8c3d1b5a16b28ab6964508e0d1ab994b59a818fef

    Score
    10/10
    ransomwarespywaresmaug

    • Smaug

      Ransomware-as-a-service first seen marketed on forums etc. in early 2020.

      ransomwaresmaug

    • Drops file in Drivers directory

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks