magniber | 896a23da24d13f598955ac6416a311816bf0d6a3d4ab41165d9a4cf6fd8c4433

General

Target

896a23da24d13f598955ac6416a311816bf0d6a3d4ab41165d9a4cf6fd8c4433.dll
Size

38KB
Sample

210822-vgvlr976da
MD5

3ead684ebe967074e0f49db375727514
SHA1

cc15ed7972a282fd1dc8da75ef89da0aa215156e
SHA256

896a23da24d13f598955ac6416a311816bf0d6a3d4ab41165d9a4cf6fd8c4433
SHA512

921393d667d1924af9f5ad8f2f2824aa3a1fe534ff178b94ef76bd857eea0a50e549c8517b51ecc2394dc3b97c4286c7c6d57dc99e6bbc51e43537c32b1b4e5e

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Documents\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://3e7454b8ee1492a0b0leaxiqtl.iizpmw37xqqwef5363j2l7nmcerqgconfa76ztt6i5uww2qj3muz3bad.onion/leaxiqtl Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://3e7454b8ee1492a0b0leaxiqtl.sadhour.space/leaxiqtl http://3e7454b8ee1492a0b0leaxiqtl.warbill.casa/leaxiqtl http://3e7454b8ee1492a0b0leaxiqtl.ballcan.xyz/leaxiqtl http://3e7454b8ee1492a0b0leaxiqtl.realbar.club/leaxiqtl Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://3e7454b8ee1492a0b0leaxiqtl.iizpmw37xqqwef5363j2l7nmcerqgconfa76ztt6i5uww2qj3muz3bad.onion/leaxiqtl

http://3e7454b8ee1492a0b0leaxiqtl.sadhour.space/leaxiqtl

http://3e7454b8ee1492a0b0leaxiqtl.warbill.casa/leaxiqtl

http://3e7454b8ee1492a0b0leaxiqtl.ballcan.xyz/leaxiqtl

http://3e7454b8ee1492a0b0leaxiqtl.realbar.club/leaxiqtl

Extracted

Path

C:\Users\Admin\Desktop\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://ae90c438aac87690leaxiqtl.iizpmw37xqqwef5363j2l7nmcerqgconfa76ztt6i5uww2qj3muz3bad.onion/leaxiqtl Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://ae90c438aac87690leaxiqtl.sadhour.space/leaxiqtl http://ae90c438aac87690leaxiqtl.warbill.casa/leaxiqtl http://ae90c438aac87690leaxiqtl.ballcan.xyz/leaxiqtl http://ae90c438aac87690leaxiqtl.realbar.club/leaxiqtl Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://ae90c438aac87690leaxiqtl.iizpmw37xqqwef5363j2l7nmcerqgconfa76ztt6i5uww2qj3muz3bad.onion/leaxiqtl

http://ae90c438aac87690leaxiqtl.sadhour.space/leaxiqtl

http://ae90c438aac87690leaxiqtl.warbill.casa/leaxiqtl

http://ae90c438aac87690leaxiqtl.ballcan.xyz/leaxiqtl

http://ae90c438aac87690leaxiqtl.realbar.club/leaxiqtl

Targets

- Target
  
  896a23da24d13f598955ac6416a311816bf0d6a3d4ab41165d9a4cf6fd8c4433.dll
- Size
  
  38KB
- MD5
  
  3ead684ebe967074e0f49db375727514
- SHA1
  
  cc15ed7972a282fd1dc8da75ef89da0aa215156e
- SHA256
  
  896a23da24d13f598955ac6416a311816bf0d6a3d4ab41165d9a4cf6fd8c4433
- SHA512
  
  921393d667d1924af9f5ad8f2f2824aa3a1fe534ff178b94ef76bd857eea0a50e549c8517b51ecc2394dc3b97c4286c7c6d57dc99e6bbc51e43537c32b1b4e5e
Score

10^/10

magniber ransomware
- Magniber Ransomware
  Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
  ransomware magniber
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2