nefilim

General

Target

d4492a9eb36f87a9b3156b59052ebaf10e264d5d1ce4c015a6b0d205614e58e3.sample
Size

70KB
Sample

210726-f6cyzvlbkx
MD5

8f90539c405672016c0dec7ac3574eea
SHA1

bd59d7c734ca2f9cbaf7f12bc851f7dce94955d4
SHA256

d4492a9eb36f87a9b3156b59052ebaf10e264d5d1ce4c015a6b0d205614e58e3
SHA512

887131d01da7d7afcff628eb1c81de7b6e6a2bb38167377dd104e175a2fec27d0d1ef0d966b376408d305488e0319b781ff996da3e5be60628088cb369869a94

Score

10^/10

nefilim ransomware

Malware Config

Extracted

Path

C:\NEFILIM-DECRYPT.txt

Ransom Note

All of your files have been encrypted with military grade algorithms. We ensure that the only way to retrieve your data is with our software. We will make sure you retrieve your data swiftly and securely when our demands are met. Restoration of your data requires a private key which only we possess. A large amount of your private files have been extracted and is kept in a secure location. If you do not contact us in seven working days of the breach we will start leaking the data. After you contact us we will provide you proof that your files have been extracted. To confirm that our decryption software works email to us 2 files from random computers. You will receive further instructions after you send us the test files. [email protected] [email protected] [email protected]

Emails

[email protected]

Targets

- Target
  
  d4492a9eb36f87a9b3156b59052ebaf10e264d5d1ce4c015a6b0d205614e58e3.sample
- Size
  
  70KB
- MD5
  
  8f90539c405672016c0dec7ac3574eea
- SHA1
  
  bd59d7c734ca2f9cbaf7f12bc851f7dce94955d4
- SHA256
  
  d4492a9eb36f87a9b3156b59052ebaf10e264d5d1ce4c015a6b0d205614e58e3
- SHA512
  
  887131d01da7d7afcff628eb1c81de7b6e6a2bb38167377dd104e175a2fec27d0d1ef0d966b376408d305488e0319b781ff996da3e5be60628088cb369869a94
Score

10^/10

nefilim ransomware
- Nefilim
  Ransomware first seen in early 2020 which shares code with the Nemty family. Rewritten in Golang in July 2020.
  ransomware nefilim
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Deletes itself
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Modifies extensions of user files

Deletes itself

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2