magniber | 2cf60c433df3dcc84b80e18c93e578bf18b31c5c49777953702c53166275796b

General

Target

magnibar_2cf60c433df3dcc84b80e18c93e578bf18b31c5c49777953702c53166275796b.exe
Size

21KB
Sample

210722-q1byeqe2q2
MD5

2953b6ec692537f8eace1077081f9e43
SHA1

6db28862c0dbb589b918f812ff61cfdac0248eab
SHA256

2cf60c433df3dcc84b80e18c93e578bf18b31c5c49777953702c53166275796b
SHA512

11959d3841c3824e5d4c68771f67db6227423d99f5beb6559c165081b6300fb3553633ce871157bd972845730fcc9e1201c10507f114d7458b3940c8cdf0ca85

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://0a9858c862607e508kmxfykjdz.5s4ixqul2enwxrqv.onion/kmxfykjdz Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://0a9858c862607e508kmxfykjdz.bestep.cyou/kmxfykjdz http://0a9858c862607e508kmxfykjdz.plughas.casa/kmxfykjdz http://0a9858c862607e508kmxfykjdz.ownhits.space/kmxfykjdz http://0a9858c862607e508kmxfykjdz.dayhit.xyz/kmxfykjdz Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://0a9858c862607e508kmxfykjdz.5s4ixqul2enwxrqv.onion/kmxfykjdz

http://0a9858c862607e508kmxfykjdz.bestep.cyou/kmxfykjdz

http://0a9858c862607e508kmxfykjdz.plughas.casa/kmxfykjdz

http://0a9858c862607e508kmxfykjdz.ownhits.space/kmxfykjdz

http://0a9858c862607e508kmxfykjdz.dayhit.xyz/kmxfykjdz

Targets

- Target
  
  magnibar_2cf60c433df3dcc84b80e18c93e578bf18b31c5c49777953702c53166275796b.exe
- Size
  
  21KB
- MD5
  
  2953b6ec692537f8eace1077081f9e43
- SHA1
  
  6db28862c0dbb589b918f812ff61cfdac0248eab
- SHA256
  
  2cf60c433df3dcc84b80e18c93e578bf18b31c5c49777953702c53166275796b
- SHA512
  
  11959d3841c3824e5d4c68771f67db6227423d99f5beb6559c165081b6300fb3553633ce871157bd972845730fcc9e1201c10507f114d7458b3940c8cdf0ca85
Score

10^/10

magniber ransomware
- Magniber Ransomware
  Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
  ransomware magniber
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Suspicious use of NtCreateProcessExOtherParentProcess
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Suspicious use of SetThreadContext
behavioral1 behavioral2