mimic

General

Target

virus-files.zip
Size

15.8MB
Sample

230808-t6fxgsfe9x
MD5

0c11768d49cd22ebee5b6ad3d7febcd6
SHA1

bb463da43458f7708aaea4931579503b067090d7
SHA256

e231cc1fb99fcca6bae8df59470f82136cb97b9f9c96a75d8cf7ab2ad4e222a0
SHA512

f440c98c762534e5203f0406c38185b164528df0a48296ee55eb5b7dd480f698023cbe95c663898dde6a2471970611055765f7b0dbb6cd127ee0516e45f9df59
SSDEEP

393216:owy0YNUtmKdreI8t7pMRRdusbu6SxpQ0uCsmTAwG3z4:5y0w8d/8/CRhbu6Sxy0uH4

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Amigodainapasik_Decryption.txt

Ransom Note

░██████╗░██████╗░███████╗███████╗████████╗██╗███╗░░██╗░██████╗░░██████╗ ███████╗██████╗░░█████╗░███╗░░░███╗ ██╔════╝░██╔══██╗██╔════╝██╔════╝╚══██╔══╝██║████╗░██║██╔════╝░██╔════╝ ██╔════╝██╔══██╗██╔══██╗████╗░████║ ██║░░██╗░██████╔╝█████╗░░█████╗░░░░░██║░░░██║██╔██╗██║██║░░██╗░╚█████╗░ █████╗░░██████╔╝██║░░██║██╔████╔██║ ██║░░╚██╗██╔══██╗██╔══╝░░██╔══╝░░░░░██║░░░██║██║╚████║██║░░╚██╗░╚═══██╗ ██╔══╝░░██╔══██╗██║░░██║██║╚██╔╝██║ ╚██████╔╝██║░░██║███████╗███████╗░░░██║░░░██║██║░╚███║╚██████╔╝██████╔╝ ██║░░░░░██║░░██║╚█████╔╝██║░╚═╝░██║ ░╚═════╝░╚═╝░░╚═╝╚══════╝╚══════╝░░░╚═╝░░░╚═╝╚═╝░░╚══╝░╚═════╝░╚═════╝░ ╚═╝░░░░░╚═╝░░╚═╝░╚════╝░╚═╝░░░░░╚═╝ ░█████╗░██╗░░░░░██████╗░░█████╗░███╗░░██╗██╗░█████╗░██╗ ██╔══██╗██║░░░░░██╔══██╗██╔══██╗████╗░██║██║██╔══██╗██║ ███████║██║░░░░░██████╦╝███████║██╔██╗██║██║███████║██║ ██╔══██║██║░░░░░██╔══██╗██╔══██║██║╚████║██║██╔══██║╚═╝ ██║░░██║███████╗██████╦╝██║░░██║██║░╚███║██║██║░░██║██╗ ╚═╝░░╚═╝╚══════╝╚═════╝░╚═╝░░╚═╝╚═╝░░╚══╝╚═╝╚═╝░░╚═╝╚═╝ -----------------------------[ Hello, My Dear Friend !!! ]-------------------------- ALL YOUR FILES HAVE BEEN ENCRYPTED DUE TO A SECURITY PROBLEM WITH YOUR PC. If you want to restore them : 1) Send your unique id dHJOfCXS8JAVmN4yRU_vHu0n1bAd8HeQ742rh-vfm28*an8uxv2w and max 3 files for test decryption OUR CONTACTS: 1.1) TOX messenger (fast and anonymous) https://tox.chat/download.html Install qtox Press sign up Create your own name Press plus Put there our tox ID: E9164A982410EFAEBC451C1D5629A2CBB75DBB6BCDBD6D2BA94F4D0A7B0B616F911496E469FB And add me/write message 1.2) ICQ Messenger ICQ live chat which works 24/7 - @Amigodainapasik Install ICQ software on your PC here https://icq.com/windows/ or on your smartphone search for "ICQ" in Appstore / Google market Write to our ICQ @Amigodainapasik https://icq.im/Amigodainapasik 1.3) Skype Amigodainapasik Decryption 1.4) Mail (write only in critical situations bcs your email may not be delivered or get in spam) * [email protected] In subject line please write your decryption ID: dHJOfCXS8JAVmN4yRU_vHu0n1bAd8HeQ742rh-vfm28*an8uxv2w You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. FREE DECRYPTION AS A GUARANTEE! Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 10Mb (non archived), and files should not contain valuable information. (databases, backups, large excel sheets, etc.) How to obtain Bitcoins: https://www.alfa.cash/buy-crypto-with-credit-card (the fastest way) buy.coingate.com https://bitcoin.org/en/buy https://buy.moonpay.io binance.com coinmama.com ATTENTION!!! Do not rename encrypted files! Do not try to decrypt your data using third party software, it may cause permanent data loss! Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you may become a victim of a scam!

Emails

[email protected]

URLs

https://tox.chat/download.html

https://icq.com/windows/

https://icq.im/Amigodainapasik

https://www.alfa.cash/buy-crypto-with-credit-card

Targets

- Target
  
  Amigodainapasik.exe
- Size
  
  2.3MB
- MD5
  
  0da0f742cf3bd80919716fbd03299189
- SHA1
  
  0ff0f5254e399aa2d487dd7f0dec032a3429f257
- SHA256
  
  8f8ce3e99d843a4beb1d3d961a7cab27e75e32490132464e448bdbcd97ddcfd5
- SHA512
  
  ce92c93973120a2808b7b33c20324f450b1e33aa1637fd2a66bc3c8f56cd44ec492e71cd8e34eb807c6cbfc5e356332b487144168de531be787ebb75ee3778f3
- SSDEEP
  
  49152:ohBJrWt7Yfg1evewmI874ZtPttM/G/jOayrdDKr:ohBJrWF04RIu4Zfa3rdOr
Score

10^/10

mimic evasion persistence ransomware trojan
- Detects Mimic ransomware
- Mimic
  Ransomware family was first exploited in the wild in 2022.
  ransomware mimic
- UAC bypass
  evasion trojan
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (2790) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes System State backups
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Downloads MZ/PE file
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1