magniber | d7ac1232f9860102bc977ecf949543f83f3d651d7a1e55af3c1d0bacddf68a2f

General

Target

tempa.dll
Size

38KB
Sample

210827-nkk9ea3yax
MD5

b90ea37466ff51b92394c61642360f27
SHA1

1137d8f12c1f1c1a4cb16b5f36a6e297b53d969c
SHA256

d7ac1232f9860102bc977ecf949543f83f3d651d7a1e55af3c1d0bacddf68a2f
SHA512

ade05a09a533c08be307303abe5fcff2fe62b23b73da1b1e1b0d9c83c8d4a93a250fc4500264f2dc7357a4c51633ed7548ec23c57a689f2045086f7de3874220

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://2260b4d0f014c040d2hvbluctpp.7cdpfkmp6tm2t7ce6m7fdldv4eor5jxotxj6v23djv73mwfstpq3ebad.onion/hvbluctpp Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://2260b4d0f014c040d2hvbluctpp.burybig.xyz/hvbluctpp http://2260b4d0f014c040d2hvbluctpp.centone.top/hvbluctpp http://2260b4d0f014c040d2hvbluctpp.joyfits.site/hvbluctpp http://2260b4d0f014c040d2hvbluctpp.dumpour.space/hvbluctpp Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://2260b4d0f014c040d2hvbluctpp.7cdpfkmp6tm2t7ce6m7fdldv4eor5jxotxj6v23djv73mwfstpq3ebad.onion/hvbluctpp

http://2260b4d0f014c040d2hvbluctpp.burybig.xyz/hvbluctpp

http://2260b4d0f014c040d2hvbluctpp.centone.top/hvbluctpp

http://2260b4d0f014c040d2hvbluctpp.joyfits.site/hvbluctpp

http://2260b4d0f014c040d2hvbluctpp.dumpour.space/hvbluctpp

Extracted

Path

C:\Users\Admin\Desktop\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://f0607a18faec44d0c2hvbluctpp.7cdpfkmp6tm2t7ce6m7fdldv4eor5jxotxj6v23djv73mwfstpq3ebad.onion/hvbluctpp Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://f0607a18faec44d0c2hvbluctpp.burybig.xyz/hvbluctpp http://f0607a18faec44d0c2hvbluctpp.centone.top/hvbluctpp http://f0607a18faec44d0c2hvbluctpp.joyfits.site/hvbluctpp http://f0607a18faec44d0c2hvbluctpp.dumpour.space/hvbluctpp Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://f0607a18faec44d0c2hvbluctpp.7cdpfkmp6tm2t7ce6m7fdldv4eor5jxotxj6v23djv73mwfstpq3ebad.onion/hvbluctpp

http://f0607a18faec44d0c2hvbluctpp.burybig.xyz/hvbluctpp

http://f0607a18faec44d0c2hvbluctpp.centone.top/hvbluctpp

http://f0607a18faec44d0c2hvbluctpp.joyfits.site/hvbluctpp

http://f0607a18faec44d0c2hvbluctpp.dumpour.space/hvbluctpp

Targets

- Target
  
  tempa.dll
- Size
  
  38KB
- MD5
  
  b90ea37466ff51b92394c61642360f27
- SHA1
  
  1137d8f12c1f1c1a4cb16b5f36a6e297b53d969c
- SHA256
  
  d7ac1232f9860102bc977ecf949543f83f3d651d7a1e55af3c1d0bacddf68a2f
- SHA512
  
  ade05a09a533c08be307303abe5fcff2fe62b23b73da1b1e1b0d9c83c8d4a93a250fc4500264f2dc7357a4c51633ed7548ec23c57a689f2045086f7de3874220
Score

10^/10

magniber ransomware
- Magniber Ransomware
  Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
  ransomware magniber
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2