Overview

overview

10

Static

static

b7eeb0746b...le.exe

windows7_x64

10

b7eeb0746b...le.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    b7eeb0746b8e5df88c9937463db3f12a07ed3cf62ff720c6c91b8610080f2d9c.sample
  • Size 363KB
  • Sample210726-7mv3pf7frj
  • SHA256 b7eeb0746b8e5df88c9937463db3f12a07ed3cf62ff720c6c91b8610080f2d9c
  • MD5 SHA1 SHA512
Score
10/10
dmalockerpersistenceransomware

Malware Config

Extracted

Path

  • C:\ProgramData\cryptinfo.txt

Ransom Note
  • Attention! ! ! All of your copies of your system have been permanently deleted and the data on all partitions and workstations have been encrypted! Stay calm. You can recover all your data by making a payment of 1072 GBP in Bitcoin currency in order to receive a decryption key. In order to purchase Bitcions you can use www.coinbase.com After buying BTC send the equivalent of 1072 GBP to our BTC adress: 166vHLnGB1pCQGxdBkRiMkHW5WGQDbsw6s After payment contact us to receive your decryption key. In mail title write your unique ID: DMALOCK 43:41:90:35:25:13:61:92 Our e-mail: [email protected] ATTENTION! To ensure you that you can recover your data we are able to decrypt two files of your choice that are not larger than 1MB! ATTENTION! Even if your antivirus has removed our program, your data may be still recovered!
Wallets

  • 166vHLnGB1pCQGxdBkRiMkHW5WGQDbsw6s

Targets

    • Target
      b7eeb0746b8e5df88c9937463db3f12a07ed3cf62ff720c6c91b8610080f2d9c.sample
    • Size 363KB
    • SHA256 b7eeb0746b8e5df88c9937463db3f12a07ed3cf62ff720c6c91b8610080f2d9c
    • MD5 SHA1 SHA512
    Score
    10/10
    dmalockerpersistenceransomware

    • DMA Locker

      Ransomware family with some advanced features, like encryption of unmapped network shares.

      ransomwaredmalocker

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks