General
- Target c6b6ec00_by_Libranalysis
- Size 22KB
- Sample210818-8e7ftqdsax
- SHA256 7ec95111e00ce9c19ebf88e9683363390873451b00e0348bca4d80ef1e4b20ed
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Desktop\readme.txt
-
magniber
Ransom Note
- ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://34704ac06214c040e8csnwyqmwa.erpp3f6j634gmj33.onion/csnwyqmwa Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://34704ac06214c040e8csnwyqmwa.jobsbig.cam/csnwyqmwa http://34704ac06214c040e8csnwyqmwa.nowuser.casa/csnwyqmwa http://34704ac06214c040e8csnwyqmwa.boxgas.icu/csnwyqmwa http://34704ac06214c040e8csnwyqmwa.bykeep.club/csnwyqmwa Note! These are temporary addresses! They will be available for a limited amount of time!
URLs
-
http://34704ac06214c040e8csnwyqmwa.erpp3f6j634gmj33.onion/csnwyqmwa
-
http://34704ac06214c040e8csnwyqmwa.jobsbig.cam/csnwyqmwa
-
http://34704ac06214c040e8csnwyqmwa.nowuser.casa/csnwyqmwa
-
http://34704ac06214c040e8csnwyqmwa.boxgas.icu/csnwyqmwa
-
http://34704ac06214c040e8csnwyqmwa.bykeep.club/csnwyqmwa
Targets
-
- Target c6b6ec00_by_Libranalysis
- Size 22KB
- SHA256 7ec95111e00ce9c19ebf88e9683363390873451b00e0348bca4d80ef1e4b20ed
Score10/10-
Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Suspicious use of SetThreadContext