magniber | b6f05d97b118f9d042c3fe691e5de7e57a84e3ea12decc86ebced93f937acead

General

Target

b6f05d97b118f9d042c3fe691e5de7e57a84e3ea12decc86ebced93f937acead.dll
Size

39KB
Sample

211225-tab9eshbhj
MD5

08fa10ed5b28440cd9e7074a546685c5
SHA1

20b6919c09bae54384c84eb92d65bb8f43a8676e
SHA256

b6f05d97b118f9d042c3fe691e5de7e57a84e3ea12decc86ebced93f937acead
SHA512

2688a37821463651fc2def76010d7f64a81899d54ddcfc8c1007ac0d69edc77b0cf0078a6fbc4ba316c7f6fd9831758c497f0f68164ba60cadd596901c983319

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://5a18de6078143ce00xtirqgc.vlqeedkmbvqdjzongyi6py6o5osehjze6r52mb2ijmx6qbh3lnb3zwid.onion/xtirqgc Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://5a18de6078143ce00xtirqgc.mensell.uno/xtirqgc http://5a18de6078143ce00xtirqgc.forrain.fit/xtirqgc http://5a18de6078143ce00xtirqgc.dayeven.space/xtirqgc http://5a18de6078143ce00xtirqgc.luckymy.quest/xtirqgc Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://5a18de6078143ce00xtirqgc.vlqeedkmbvqdjzongyi6py6o5osehjze6r52mb2ijmx6qbh3lnb3zwid.onion/xtirqgc

http://5a18de6078143ce00xtirqgc.mensell.uno/xtirqgc

http://5a18de6078143ce00xtirqgc.forrain.fit/xtirqgc

http://5a18de6078143ce00xtirqgc.dayeven.space/xtirqgc

http://5a18de6078143ce00xtirqgc.luckymy.quest/xtirqgc

Extracted

Path

C:\Users\Admin\Desktop\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://7aa40280a03068106xtirqgc.vlqeedkmbvqdjzongyi6py6o5osehjze6r52mb2ijmx6qbh3lnb3zwid.onion/xtirqgc Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://7aa40280a03068106xtirqgc.mensell.uno/xtirqgc http://7aa40280a03068106xtirqgc.forrain.fit/xtirqgc http://7aa40280a03068106xtirqgc.dayeven.space/xtirqgc http://7aa40280a03068106xtirqgc.luckymy.quest/xtirqgc Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://7aa40280a03068106xtirqgc.vlqeedkmbvqdjzongyi6py6o5osehjze6r52mb2ijmx6qbh3lnb3zwid.onion/xtirqgc

http://7aa40280a03068106xtirqgc.mensell.uno/xtirqgc

http://7aa40280a03068106xtirqgc.forrain.fit/xtirqgc

http://7aa40280a03068106xtirqgc.dayeven.space/xtirqgc

http://7aa40280a03068106xtirqgc.luckymy.quest/xtirqgc

Targets

- Target
  
  b6f05d97b118f9d042c3fe691e5de7e57a84e3ea12decc86ebced93f937acead.dll
- Size
  
  39KB
- MD5
  
  08fa10ed5b28440cd9e7074a546685c5
- SHA1
  
  20b6919c09bae54384c84eb92d65bb8f43a8676e
- SHA256
  
  b6f05d97b118f9d042c3fe691e5de7e57a84e3ea12decc86ebced93f937acead
- SHA512
  
  2688a37821463651fc2def76010d7f64a81899d54ddcfc8c1007ac0d69edc77b0cf0078a6fbc4ba316c7f6fd9831758c497f0f68164ba60cadd596901c983319
Score

10^/10

magniber ransomware
- Magniber Ransomware
  Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
  ransomware magniber
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Generic Ransomware Note
  Ransomware often writes a note containing information on how to pay the ransom.
- Suspicious use of SetThreadContext
behavioral1 behavioral2