Overview

overview

10

Static

static

10

avi.exe

windows7-x64

10

avi.exe

windows10-2004-x64

10

Resubmissions

09/03/2023, 23:09

230309-244jrsaf7910

09/03/2023, 23:06

230309-23pdfscd4v10

12/10/2022, 19:46

221012-ygzqhsaabj9

Sharing

Copy URL Twitter E-mail

General

  • Target
    avi.exe
  • Size 2.9MB
  • Sample230309-244jrsaf79
  • SHA256 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
royalransomware

Malware Config

Extracted

Path

  • C:\Program Files (x86)\README.TXT

  • royal

Ransom Note
  • Hello! If you are reading this, it means that your system were hit by Royal ransomware. Please contact us via : http://royal2xthig3ou5hd7zsliqagy6yygk2cdelaxtni2fyad6dpmpxedid.onion/12345678123456781234567812346578 In the meantime, let us explain this case.It may seem complicated, but it is not! Most likely what happened was that you decided to save some money on your security infrastructure. Alas, as a result your critical data was not only encrypted but also copied from your systems on a secure server. From there it can be published online.Then anyone on the internet from darknet criminals, ACLU journalists, Chinese government(different names for the same thing), and even your employees will be able to see your internal documentation: personal data, HR reviews, internal lawsuitsand complains, financial reports, accounting, intellectual property, and more! Fortunately we got you covered! Royal offers you a unique deal.For a modest royalty(got it; got it ? ) for our pentesting services we will not only provide you with an amazing risk mitigation service, covering you from reputational, legal, financial, regulatory, and insurance risks, but will also provide you with a security review for your systems. To put it simply, your files will be decrypted, your data restoredand kept confidential, and your systems will remain secure. Try Royal today and enter the new era of data security! We are looking to hearing from you soon!
URLs

  • http://royal2xthig3ou5hd7zsliqagy6yygk2cdelaxtni2fyad6dpmpxedid.onion/12345678123456781234567812346578

Targets

    • Target
      avi.exe
    • Size 2.9MB
    • SHA256 f484f919ba6e36ff33e4fb391b8859a94d89c172a465964f99d6113b55ced429
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    royalransomware

    • Royal

      Royal is a ransomware first seen in 2022.

      ransomwareroyal

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Drops startup file

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks