filecoder | fa9d1664ef9192b50228d7c21589f4fe9f3002faa503b39666a8a3bcd03ed635

General

Target

fa9d1664ef9192b50228d7c21589f4fe9f3002faa503b39666a8a3bcd03ed635
Size

6.8MB
Sample

220203-gx1jbadeb5
MD5

57d941c6c2b1425ff9b9679024b8738f
SHA1

b502874681a709e48f3d1ddfa6ae398499f4bd23
SHA256

fa9d1664ef9192b50228d7c21589f4fe9f3002faa503b39666a8a3bcd03ed635
SHA512

e819aa27e999a12eaa6d5f5b756bb8af9cdecb4c0399f9c9a4456398897f7e03547eee07ab907d1cf392879acf4c8084ee011f75c821a07db9d55b53cac995b6

Score

10^/10

Malware Config

Extracted

Path

res/layout/activity_main.xml

Family

filecoder

Ransom Note

Current State Information Your personal documents and files on this device have just been crypted.The origion files have been completely deleted and will only be recovered by following the steps described below. Document Decryption Operation Guide 1. To obtain the key which will decrypt files,you need to pay the amount of Bitcoin you see at the top of the screen. 2. After the payment is completed, open %s and enter the userid below, you will get the decryption key. 3. Paste the decryption key in the key inputbox below and click the decrypt button.Reboot the phone,all files will be successfully decrypted. Decrypt Key: paste your key here... Useful Information UserID: BTC addr: 16KQjht4ePZxxGPr3es24VQyMYgR9UEkFy !!!Do not delete this APP,or your files will not be back forever!!!

Wallets

16KQjht4ePZxxGPr3es24VQyMYgR9UEkFy

Targets

- Target
  
  fa9d1664ef9192b50228d7c21589f4fe9f3002faa503b39666a8a3bcd03ed635
- Size
  
  6.8MB
- MD5
  
  57d941c6c2b1425ff9b9679024b8738f
- SHA1
  
  b502874681a709e48f3d1ddfa6ae398499f4bd23
- SHA256
  
  fa9d1664ef9192b50228d7c21589f4fe9f3002faa503b39666a8a3bcd03ed635
- SHA512
  
  e819aa27e999a12eaa6d5f5b756bb8af9cdecb4c0399f9c9a4456398897f7e03547eee07ab907d1cf392879acf4c8084ee011f75c821a07db9d55b53cac995b6
Score

10^/10

filecoder ransomware
- Filecoder.C
  A ransomware family that spreads to other victims via SMS.
  ransomware filecoder
- Legitimate hosting services abused for malware hosting/C2
- Uses Crypto APIs (Might try to encrypt user data).
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

1

T1102

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Filecoder.C

Legitimate hosting services abused for malware hosting/C2

Uses Crypto APIs (Might try to encrypt user data).

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2