magniber | 612cd74d2ed040ec2958e78ae80b39231f4eb130e2ddb74c8d90a2c1fddd1fa0

General

Target

fabubbjd.inf
Size

39KB
Sample

211124-gedltscafl
MD5

b086c689ad65afd62dadcf6a1fb799a3
SHA1

de77db799a7bc43bb7c6208cfdd58e8457cf1061
SHA256

612cd74d2ed040ec2958e78ae80b39231f4eb130e2ddb74c8d90a2c1fddd1fa0
SHA512

1b3ba45981151b5c8e89f93b84fdf0ce54e2d9bbbfa18bc2e0d0af2e3dccb4dc6d070640c6b3c7970c1c9d2bb2c109bfce12f99cd402975ae97982f6fa680aca

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://a0eca668162cd6801actzpapmiv.3g5twxggjkc76oy6itmdvhliayffjfv23vg3rp372nn7ohfnnylfclid.onion/ctzpapmiv Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://a0eca668162cd6801actzpapmiv.vansban.space/ctzpapmiv http://a0eca668162cd6801actzpapmiv.hemore.uno/ctzpapmiv http://a0eca668162cd6801actzpapmiv.trapbe.quest/ctzpapmiv http://a0eca668162cd6801actzpapmiv.hotgame.fit/ctzpapmiv Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://a0eca668162cd6801actzpapmiv.3g5twxggjkc76oy6itmdvhliayffjfv23vg3rp372nn7ohfnnylfclid.onion/ctzpapmiv

http://a0eca668162cd6801actzpapmiv.vansban.space/ctzpapmiv

http://a0eca668162cd6801actzpapmiv.hemore.uno/ctzpapmiv

http://a0eca668162cd6801actzpapmiv.trapbe.quest/ctzpapmiv

http://a0eca668162cd6801actzpapmiv.hotgame.fit/ctzpapmiv

Extracted

Path

C:\Users\Admin\Desktop\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://166ca4208a7ca270eectzpapmiv.3g5twxggjkc76oy6itmdvhliayffjfv23vg3rp372nn7ohfnnylfclid.onion/ctzpapmiv Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://166ca4208a7ca270eectzpapmiv.vansban.space/ctzpapmiv http://166ca4208a7ca270eectzpapmiv.hemore.uno/ctzpapmiv http://166ca4208a7ca270eectzpapmiv.trapbe.quest/ctzpapmiv http://166ca4208a7ca270eectzpapmiv.hotgame.fit/ctzpapmiv Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://166ca4208a7ca270eectzpapmiv.3g5twxggjkc76oy6itmdvhliayffjfv23vg3rp372nn7ohfnnylfclid.onion/ctzpapmiv

http://166ca4208a7ca270eectzpapmiv.vansban.space/ctzpapmiv

http://166ca4208a7ca270eectzpapmiv.hemore.uno/ctzpapmiv

http://166ca4208a7ca270eectzpapmiv.trapbe.quest/ctzpapmiv

http://166ca4208a7ca270eectzpapmiv.hotgame.fit/ctzpapmiv

Targets

- Target
  
  fabubbjd.inf
- Size
  
  39KB
- MD5
  
  b086c689ad65afd62dadcf6a1fb799a3
- SHA1
  
  de77db799a7bc43bb7c6208cfdd58e8457cf1061
- SHA256
  
  612cd74d2ed040ec2958e78ae80b39231f4eb130e2ddb74c8d90a2c1fddd1fa0
- SHA512
  
  1b3ba45981151b5c8e89f93b84fdf0ce54e2d9bbbfa18bc2e0d0af2e3dccb4dc6d070640c6b3c7970c1c9d2bb2c109bfce12f99cd402975ae97982f6fa680aca
Score

10^/10

magniber ransomware
- Magniber Ransomware
  Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
  ransomware magniber
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2