Overview

overview

10

Static

static

10

d4492a9eb3...le.exe

windows7_x64

10

d4492a9eb3...le.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d4492a9eb36f87a9b3156b59052ebaf10e264d5d1ce4c015a6b0d205614e58e3.sample

  • Size

    70KB

  • Sample

    210726-f6cyzvlbkx

  • MD5

    8f90539c405672016c0dec7ac3574eea

  • SHA1

    bd59d7c734ca2f9cbaf7f12bc851f7dce94955d4

  • SHA256

    d4492a9eb36f87a9b3156b59052ebaf10e264d5d1ce4c015a6b0d205614e58e3

  • SHA512

    887131d01da7d7afcff628eb1c81de7b6e6a2bb38167377dd104e175a2fec27d0d1ef0d966b376408d305488e0319b781ff996da3e5be60628088cb369869a94

Score
10/10
nefilimransomware

Malware Config

Extracted

Path

C:\NEFILIM-DECRYPT.txt

Ransom Note
All of your files have been encrypted with military grade algorithms. We ensure that the only way to retrieve your data is with our software. We will make sure you retrieve your data swiftly and securely when our demands are met. Restoration of your data requires a private key which only we possess. A large amount of your private files have been extracted and is kept in a secure location. If you do not contact us in seven working days of the breach we will start leaking the data. After you contact us we will provide you proof that your files have been extracted. To confirm that our decryption software works email to us 2 files from random computers. You will receive further instructions after you send us the test files. [email protected] [email protected] [email protected]

Targets

    • Target

      d4492a9eb36f87a9b3156b59052ebaf10e264d5d1ce4c015a6b0d205614e58e3.sample

    • Size

      70KB

    • MD5

      8f90539c405672016c0dec7ac3574eea

    • SHA1

      bd59d7c734ca2f9cbaf7f12bc851f7dce94955d4

    • SHA256

      d4492a9eb36f87a9b3156b59052ebaf10e264d5d1ce4c015a6b0d205614e58e3

    • SHA512

      887131d01da7d7afcff628eb1c81de7b6e6a2bb38167377dd104e175a2fec27d0d1ef0d966b376408d305488e0319b781ff996da3e5be60628088cb369869a94

    Score
    10/10
    nefilimransomware

    • Nefilim

      Ransomware first seen in early 2020 which shares code with the Nemty family. Rewritten in Golang in July 2020.

      ransomwarenefilim

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks