magniber | 463b34821a8eb219ff5980787d95bc2cfdd2d7f82720163394973814cd5dfe40

General

Target

3ad0af44a4269c0121eeb19cee197a90b4a7e862b5ce04eab6aafc021dd6e7a3.exe
Size

125KB
Sample

210907-te919agbbq
MD5

f9bf85cfb68d9e5f68bbccaf683af15c
SHA1

a2eae8c1350fcfa429d2af664d8320edbfabe5d3
SHA256

463b34821a8eb219ff5980787d95bc2cfdd2d7f82720163394973814cd5dfe40
SHA512

07032679f19bba5690b59a6b689859d0b3611995cca6f990d2eee4b2f586493b29e70b4525e057abefe79a86695fa934f52e175a12098e0eeef7c1e3d049066a

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://5c90f04882607e909qwfekni.n5fnrf4l7bdjhelx.onion/qwfekni Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://5c90f04882607e909qwfekni.perages.cyou/qwfekni http://5c90f04882607e909qwfekni.aimdrop.fit/qwfekni http://5c90f04882607e909qwfekni.soblack.xyz/qwfekni http://5c90f04882607e909qwfekni.sixsees.club/qwfekni Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://5c90f04882607e909qwfekni.n5fnrf4l7bdjhelx.onion/qwfekni

http://5c90f04882607e909qwfekni.perages.cyou/qwfekni

http://5c90f04882607e909qwfekni.aimdrop.fit/qwfekni

http://5c90f04882607e909qwfekni.soblack.xyz/qwfekni

http://5c90f04882607e909qwfekni.sixsees.club/qwfekni

Targets

- Target
  
  3ad0af44a4269c0121eeb19cee197a90b4a7e862b5ce04eab6aafc021dd6e7a3.exe
- Size
  
  125KB
- MD5
  
  f9bf85cfb68d9e5f68bbccaf683af15c
- SHA1
  
  a2eae8c1350fcfa429d2af664d8320edbfabe5d3
- SHA256
  
  463b34821a8eb219ff5980787d95bc2cfdd2d7f82720163394973814cd5dfe40
- SHA512
  
  07032679f19bba5690b59a6b689859d0b3611995cca6f990d2eee4b2f586493b29e70b4525e057abefe79a86695fa934f52e175a12098e0eeef7c1e3d049066a
Score

10^/10

magniber ransomware
- Magniber Ransomware
  Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
  ransomware magniber
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Suspicious use of SetThreadContext
behavioral1 behavioral2