Overview

overview

10

Static

static

Trojan.Win...64.exe

windows7-x64

10

Trojan.Win...64.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Trojan.Win32.Fsysna.gafh-d9d01bff3bf98b37793eb9d74e713cc340b7d9ad40d0c6437f422c41fca73364.exe

  • Size

    834KB

  • Sample

    220924-lm78mabab3

  • MD5

    20b61a16f732ba0646ff501f37ce4e4e

  • SHA1

    8668c2041ebd9e56c1c4e14a4164569922729c35

  • SHA256

    d9d01bff3bf98b37793eb9d74e713cc340b7d9ad40d0c6437f422c41fca73364

  • SHA512

    9dd12047b7b020d4be9f2eea4196502750d38652cc287dbae1355277e7047a74f421fe910e2ebd2eb4634e07a00a4ded70e0ceb2540d34e18ba7b63eaba91f3f

  • SSDEEP

    24576:XmqE0fhdkphXlbKmL6P3t7uv8gOkwtTXIWO:XzAhfsd7uB7wtT

Score
10/10
evasionpersistenceransomwaretrojan

Malware Config

Extracted

Path

C:\Users\Admin\Fix_ReadMe.txt

Ransom Note
Your documents, photos, databases and other important files are encrypted with RSA-2048 encryption , for more information search in Google “RSA encryption”. Don't worry, you can return all your files! The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. if you want to decrypt your files You must pay 350$ bitcoin to wallet: 34gkQtAhK9jDDRy7SWTLsnzRmubv7yRhDv To get this software you need write on our e-mail: CryptoLocky_123456@protonmail.com What guarantees do we give to you? You can send 2 your encrypted file from your PC and we decrypt it for free. DO NOT RENAME the encrypted files. DO NOT MOVE the encrypted files. DO NOT RESET OR SHUTDOWN - files may be damaged. Your Personal ID : BED4cGJN3cPGcOR5834KACCAM1CGMGE0B0G118aHOFHRCJ0c10NcQIcaCCLGEDBQ75FIHcIA4Rf5f5kDaJ1acLEc0HR0QcDKEa5I
Emails

CryptoLocky_123456@protonmail.com

Wallets

34gkQtAhK9jDDRy7SWTLsnzRmubv7yRhDv

Extracted

Path

C:\Users\Admin\Desktop\Fix_ReadMe.txt

Ransom Note
Your documents, photos, databases and other important files are encrypted with RSA-2048 encryption , for more information search in Google “RSA encryption”. Don't worry, you can return all your files! The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. if you want to decrypt your files You must pay 350$ bitcoin to wallet: 34gkQtAhK9jDDRy7SWTLsnzRmubv7yRhDv To get this software you need write on our e-mail: CryptoLocky_123456@protonmail.com What guarantees do we give to you? You can send 2 your encrypted file from your PC and we decrypt it for free. DO NOT RENAME the encrypted files. DO NOT MOVE the encrypted files. DO NOT RESET OR SHUTDOWN - files may be damaged. Your personal ID : BED4cGJN3cPGcOR5834KACCAM1CGMGE0B0G118aHOFHRCJ0c10NcQIcaCCLGEDBQ75FIHcIA4Rf5f5kDaJ1acLEc0HR0QcDKEa5I
Emails

CryptoLocky_123456@protonmail.com

Wallets

34gkQtAhK9jDDRy7SWTLsnzRmubv7yRhDv

Extracted

Path

C:\Users\Admin\Fix_ReadMe.txt

Ransom Note
Your documents, photos, databases and other important files are encrypted with RSA-2048 encryption , for more information search in Google “RSA encryption”. Don't worry, you can return all your files! The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. if you want to decrypt your files You must pay 350$ bitcoin to wallet: 34gkQtAhK9jDDRy7SWTLsnzRmubv7yRhDv To get this software you need write on our e-mail: CryptoLocky_123456@protonmail.com What guarantees do we give to you? You can send 2 your encrypted file from your PC and we decrypt it for free. DO NOT RENAME the encrypted files. DO NOT MOVE the encrypted files. DO NOT RESET OR SHUTDOWN - files may be damaged. Your Personal ID : OG05CfQcINDKFba40bIRFACbLa0aLcMM3PEQ4sbc07CkcCCIk0aaE50OEfHMMQ0PAa0a0Ja7aQf0kEkI3KB48MI5s4L53OPEA0cB
Emails

CryptoLocky_123456@protonmail.com

Wallets

34gkQtAhK9jDDRy7SWTLsnzRmubv7yRhDv

Extracted

Path

C:\Users\Admin\Desktop\Fix_ReadMe.txt

Ransom Note
Your documents, photos, databases and other important files are encrypted with RSA-2048 encryption , for more information search in Google “RSA encryption”. Don't worry, you can return all your files! The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. if you want to decrypt your files You must pay 350$ bitcoin to wallet: 34gkQtAhK9jDDRy7SWTLsnzRmubv7yRhDv To get this software you need write on our e-mail: CryptoLocky_123456@protonmail.com What guarantees do we give to you? You can send 2 your encrypted file from your PC and we decrypt it for free. DO NOT RENAME the encrypted files. DO NOT MOVE the encrypted files. DO NOT RESET OR SHUTDOWN - files may be damaged. Your personal ID : OG05CfQcINDKFba40bIRFACbLa0aLcMM3PEQ4sbc07CkcCCIk0aaE50OEfHMMQ0PAa0a0Ja7aQf0kEkI3KB48MI5s4L53OPEA0cB
Emails

CryptoLocky_123456@protonmail.com

Wallets

34gkQtAhK9jDDRy7SWTLsnzRmubv7yRhDv

Targets

    • Target

      Trojan.Win32.Fsysna.gafh-d9d01bff3bf98b37793eb9d74e713cc340b7d9ad40d0c6437f422c41fca73364.exe

    • Size

      834KB

    • MD5

      20b61a16f732ba0646ff501f37ce4e4e

    • SHA1

      8668c2041ebd9e56c1c4e14a4164569922729c35

    • SHA256

      d9d01bff3bf98b37793eb9d74e713cc340b7d9ad40d0c6437f422c41fca73364

    • SHA512

      9dd12047b7b020d4be9f2eea4196502750d38652cc287dbae1355277e7047a74f421fe910e2ebd2eb4634e07a00a4ded70e0ceb2540d34e18ba7b63eaba91f3f

    • SSDEEP

      24576:XmqE0fhdkphXlbKmL6P3t7uv8gOkwtTXIWO:XzAhfsd7uB7wtT

    Score
    10/10
    evasionransomwaretrojanpersistence

    • UAC bypass

      evasiontrojan

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Modify Registry

4
T1112

File Deletion

2
T1107

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Inhibit System Recovery

2
T1490

Tasks