magniber | 5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35

General

Target

4.exe
Size

21KB
Sample

210622-sfxtrez4va
MD5

191889cccd8827cb28b5cf9c3a559366
SHA1

c1a6bc0e5d66524eaefa935e9d1dca0c9223bead
SHA256

5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35
SHA512

6d3af286eaa1c3051a739edeaa5f5684f31ff0575082bcd1c2155acfa82657b06b70d7aefc55be3dc1f0877cd4ca77b13f9e53720f5123339bf85eb36bfdfcdf

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://2604a8602014c040e8uxkhdcf.ndkeblzjnpqgpo5o.onion/uxkhdcf Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://2604a8602014c040e8uxkhdcf.bejoin.space/uxkhdcf http://2604a8602014c040e8uxkhdcf.lieedge.casa/uxkhdcf http://2604a8602014c040e8uxkhdcf.wonride.site/uxkhdcf http://2604a8602014c040e8uxkhdcf.lognear.xyz/uxkhdcf Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://2604a8602014c040e8uxkhdcf.ndkeblzjnpqgpo5o.onion/uxkhdcf

http://2604a8602014c040e8uxkhdcf.bejoin.space/uxkhdcf

http://2604a8602014c040e8uxkhdcf.lieedge.casa/uxkhdcf

http://2604a8602014c040e8uxkhdcf.wonride.site/uxkhdcf

http://2604a8602014c040e8uxkhdcf.lognear.xyz/uxkhdcf

Targets

- Target
  
  4.exe
- Size
  
  21KB
- MD5
  
  191889cccd8827cb28b5cf9c3a559366
- SHA1
  
  c1a6bc0e5d66524eaefa935e9d1dca0c9223bead
- SHA256
  
  5301e5deb37674296e48d5873862ce32f934fbdfe1a7919f97bddb1138957e35
- SHA512
  
  6d3af286eaa1c3051a739edeaa5f5684f31ff0575082bcd1c2155acfa82657b06b70d7aefc55be3dc1f0877cd4ca77b13f9e53720f5123339bf85eb36bfdfcdf
Score

10^/10

magniber ransomware
- Magniber Ransomware
  Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
  ransomware magniber
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Suspicious use of NtCreateProcessExOtherParentProcess
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Tasks

Sharing

General

Malware Config

Extracted

Targets

Magniber Ransomware

Process spawned unexpected child process

Suspicious use of NtCreateProcessExOtherParentProcess

Deletes shadow copies

Modifies extensions of user files

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2