Description
Ransomware generally changes the extension on encrypted files.
VanGoth.exe
General
Target
Size
Sample
VanGoth.exe
36KB
211014-bw4lpafef9
Score
8 /10
MD5
SHA1
SHA256
SHA512
afff555062c4e6fb3a34e7c2be519fcd
73ed552ba04e57e8cd991f9f82a182aa298c4baa
d27a5719ec67c146a1b338302074de39f5ad49b17f81cb014cc2c57c4f464d85
31b3b0cf4e877f848fae85c7afd08fe165ae5bcb114d41781d28403e276f524d383e34f7d3e39b96beb8e39f023ae1d150115bf751a3196e3c773eb688a6277f
Malware Config
Targets
Target
MD5
Filesize
VanGoth.exe
afff555062c4e6fb3a34e7c2be519fcd
36KB
Score
8/10
SHA1
SHA256
SHA512
73ed552ba04e57e8cd991f9f82a182aa298c4baa
d27a5719ec67c146a1b338302074de39f5ad49b17f81cb014cc2c57c4f464d85
31b3b0cf4e877f848fae85c7afd08fe165ae5bcb114d41781d28403e276f524d383e34f7d3e39b96beb8e39f023ae1d150115bf751a3196e3c773eb688a6277f
Tags
Signatures
-
Drops file in Drivers directory
-
Modifies extensions of user files
-
Reads user/profile data of web browsers
Description
Infostealers often target stored browser data, which can include saved credentials etc.
Tags
TTPs
-
Drops file in System32 directory
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks