magniber | 4f928d4bb28ac45b5d8a7ac8c0a4822dc23a4815a31bc4b4b2dd6ab34cb32a9b

General

Target

4.dll
Size

38KB
Sample

210829-4v1tly9mrx
MD5

20dc89faf3ec56190b7eeb2e31807e42
SHA1

7cf5f418a3fa466fadde536fb52c5df9594fb319
SHA256

4f928d4bb28ac45b5d8a7ac8c0a4822dc23a4815a31bc4b4b2dd6ab34cb32a9b
SHA512

7433189602bc530c4099ab2e4c2c19c433f6555386e385ea88ae163d5f6b3ab1c2f5dcb9d3101779a428ec669236e4f64ad13ee8ed7ce82a22d6be9bb6869fc9

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://d61084d87c784a7092cytywyhto.ntjflrx6uhwcmfhnn3yewv2wfhtqtjyfkvyrvjz4wuo6uw33yw7sfiid.onion/cytywyhto Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://d61084d87c784a7092cytywyhto.bitslet.uno/cytywyhto http://d61084d87c784a7092cytywyhto.canyour.xyz/cytywyhto http://d61084d87c784a7092cytywyhto.dogper.space/cytywyhto http://d61084d87c784a7092cytywyhto.ballcan.xyz/cytywyhto Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://d61084d87c784a7092cytywyhto.ntjflrx6uhwcmfhnn3yewv2wfhtqtjyfkvyrvjz4wuo6uw33yw7sfiid.onion/cytywyhto

http://d61084d87c784a7092cytywyhto.bitslet.uno/cytywyhto

http://d61084d87c784a7092cytywyhto.canyour.xyz/cytywyhto

http://d61084d87c784a7092cytywyhto.dogper.space/cytywyhto

http://d61084d87c784a7092cytywyhto.ballcan.xyz/cytywyhto

Extracted

Path

C:\Users\Admin\Desktop\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://04007c5886ec44d04ecytywyhto.ntjflrx6uhwcmfhnn3yewv2wfhtqtjyfkvyrvjz4wuo6uw33yw7sfiid.onion/cytywyhto Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://04007c5886ec44d04ecytywyhto.bitslet.uno/cytywyhto http://04007c5886ec44d04ecytywyhto.canyour.xyz/cytywyhto http://04007c5886ec44d04ecytywyhto.dogper.space/cytywyhto http://04007c5886ec44d04ecytywyhto.ballcan.xyz/cytywyhto Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://04007c5886ec44d04ecytywyhto.ntjflrx6uhwcmfhnn3yewv2wfhtqtjyfkvyrvjz4wuo6uw33yw7sfiid.onion/cytywyhto

http://04007c5886ec44d04ecytywyhto.bitslet.uno/cytywyhto

http://04007c5886ec44d04ecytywyhto.canyour.xyz/cytywyhto

http://04007c5886ec44d04ecytywyhto.dogper.space/cytywyhto

http://04007c5886ec44d04ecytywyhto.ballcan.xyz/cytywyhto

Targets

- Target
  
  4.dll
- Size
  
  38KB
- MD5
  
  20dc89faf3ec56190b7eeb2e31807e42
- SHA1
  
  7cf5f418a3fa466fadde536fb52c5df9594fb319
- SHA256
  
  4f928d4bb28ac45b5d8a7ac8c0a4822dc23a4815a31bc4b4b2dd6ab34cb32a9b
- SHA512
  
  7433189602bc530c4099ab2e4c2c19c433f6555386e385ea88ae163d5f6b3ab1c2f5dcb9d3101779a428ec669236e4f64ad13ee8ed7ce82a22d6be9bb6869fc9
Score

10^/10

magniber ransomware
- Magniber Ransomware
  Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
  ransomware magniber
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2