mimic

Resubmissions

08-08-2023 16:39

230808-t6fxgsfe9x 10

08-08-2023 16:13

230808-tpj8ksdh34 10

Sharing

Copy URL

Twitter E-mail

General

Target

virus-files.zip
Size

15.8MB
Sample

230808-tpj8ksdh34
MD5

0c11768d49cd22ebee5b6ad3d7febcd6
SHA1

bb463da43458f7708aaea4931579503b067090d7
SHA256

e231cc1fb99fcca6bae8df59470f82136cb97b9f9c96a75d8cf7ab2ad4e222a0
SHA512

f440c98c762534e5203f0406c38185b164528df0a48296ee55eb5b7dd480f698023cbe95c663898dde6a2471970611055765f7b0dbb6cd127ee0516e45f9df59
SSDEEP

393216:owy0YNUtmKdreI8t7pMRRdusbu6SxpQ0uCsmTAwG3z4:5y0w8d/8/CRhbu6Sxy0uH4

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Amigodainapasik_Decryption.txt

Ransom Note

░██████╗░██████╗░███████╗███████╗████████╗██╗███╗░░██╗░██████╗░░██████╗ ███████╗██████╗░░█████╗░███╗░░░███╗ ██╔════╝░██╔══██╗██╔════╝██╔════╝╚══██╔══╝██║████╗░██║██╔════╝░██╔════╝ ██╔════╝██╔══██╗██╔══██╗████╗░████║ ██║░░██╗░██████╔╝█████╗░░█████╗░░░░░██║░░░██║██╔██╗██║██║░░██╗░╚█████╗░ █████╗░░██████╔╝██║░░██║██╔████╔██║ ██║░░╚██╗██╔══██╗██╔══╝░░██╔══╝░░░░░██║░░░██║██║╚████║██║░░╚██╗░╚═══██╗ ██╔══╝░░██╔══██╗██║░░██║██║╚██╔╝██║ ╚██████╔╝██║░░██║███████╗███████╗░░░██║░░░██║██║░╚███║╚██████╔╝██████╔╝ ██║░░░░░██║░░██║╚█████╔╝██║░╚═╝░██║ ░╚═════╝░╚═╝░░╚═╝╚══════╝╚══════╝░░░╚═╝░░░╚═╝╚═╝░░╚══╝░╚═════╝░╚═════╝░ ╚═╝░░░░░╚═╝░░╚═╝░╚════╝░╚═╝░░░░░╚═╝ ░█████╗░██╗░░░░░██████╗░░█████╗░███╗░░██╗██╗░█████╗░██╗ ██╔══██╗██║░░░░░██╔══██╗██╔══██╗████╗░██║██║██╔══██╗██║ ███████║██║░░░░░██████╦╝███████║██╔██╗██║██║███████║██║ ██╔══██║██║░░░░░██╔══██╗██╔══██║██║╚████║██║██╔══██║╚═╝ ██║░░██║███████╗██████╦╝██║░░██║██║░╚███║██║██║░░██║██╗ ╚═╝░░╚═╝╚══════╝╚═════╝░╚═╝░░╚═╝╚═╝░░╚══╝╚═╝╚═╝░░╚═╝╚═╝ -----------------------------[ Hello, My Dear Friend !!! ]-------------------------- ALL YOUR FILES HAVE BEEN ENCRYPTED DUE TO A SECURITY PROBLEM WITH YOUR PC. If you want to restore them : 1) Send your unique id dHJOfCXS8JAVmN4yRU_vHu0n1bAd8HeQ742rh-vfm28*an8uxv2w and max 3 files for test decryption OUR CONTACTS: 1.1) TOX messenger (fast and anonymous) https://tox.chat/download.html Install qtox Press sign up Create your own name Press plus Put there our tox ID: E9164A982410EFAEBC451C1D5629A2CBB75DBB6BCDBD6D2BA94F4D0A7B0B616F911496E469FB And add me/write message 1.2) ICQ Messenger ICQ live chat which works 24/7 - @Amigodainapasik Install ICQ software on your PC here https://icq.com/windows/ or on your smartphone search for "ICQ" in Appstore / Google market Write to our ICQ @Amigodainapasik https://icq.im/Amigodainapasik 1.3) Skype Amigodainapasik Decryption 1.4) Mail (write only in critical situations bcs your email may not be delivered or get in spam) * [email protected] In subject line please write your decryption ID: dHJOfCXS8JAVmN4yRU_vHu0n1bAd8HeQ742rh-vfm28*an8uxv2w You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. FREE DECRYPTION AS A GUARANTEE! Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 10Mb (non archived), and files should not contain valuable information. (databases, backups, large excel sheets, etc.) How to obtain Bitcoins: https://www.alfa.cash/buy-crypto-with-credit-card (the fastest way) buy.coingate.com https://bitcoin.org/en/buy https://buy.moonpay.io binance.com coinmama.com ATTENTION!!! Do not rename encrypted files! Do not try to decrypt your data using third party software, it may cause permanent data loss! Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you may become a victim of a scam!

Emails

[email protected]

URLs

https://tox.chat/download.html

https://icq.com/windows/

https://icq.im/Amigodainapasik

https://www.alfa.cash/buy-crypto-with-credit-card

Targets

- Target
  
  7za.exe
- Size
  
  772KB
- MD5
  
  b93eb0a48c91a53bda6a1a074a4b431e
- SHA1
  
  ac693a14c697b1a8ee80318e260e817b8ee2aa86
- SHA256
  
  ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142
- SHA512
  
  732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5
- SSDEEP
  
  24576:DFhjj7f4K+ao308d0ORMz27R0iIdclDJiD:JlwpP90OFWxD
Score

1^/10
behavioral1 behavioral2
- Target
  
  Amigodainapasik.exe
- Size
  
  2.3MB
- MD5
  
  0da0f742cf3bd80919716fbd03299189
- SHA1
  
  0ff0f5254e399aa2d487dd7f0dec032a3429f257
- SHA256
  
  8f8ce3e99d843a4beb1d3d961a7cab27e75e32490132464e448bdbcd97ddcfd5
- SHA512
  
  ce92c93973120a2808b7b33c20324f450b1e33aa1637fd2a66bc3c8f56cd44ec492e71cd8e34eb807c6cbfc5e356332b487144168de531be787ebb75ee3778f3
- SSDEEP
  
  49152:ohBJrWt7Yfg1evewmI874ZtPttM/G/jOayrdDKr:ohBJrWF04RIu4Zfa3rdOr
Score

10^/10

mimic evasion persistence ransomware trojan
- Detects Mimic ransomware
- Mimic
  Ransomware family was first exploited in the wild in 2022.
  ransomware mimic
- UAC bypass
  evasion trojan
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (2795) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Renames multiple (5801) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes System State backups
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  
  Everything.exe
- Size
  
  1.7MB
- MD5
  
  c44487ce1827ce26ac4699432d15b42a
- SHA1
  
  8434080fad778057a50607364fee8b481f0feef8
- SHA256
  
  4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405
- SHA512
  
  a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808
- SSDEEP
  
  49152:sVzyP4BTkT3EApTLi2CCzMn3jzjAhFEy+eaXr:sVzyABTwEH
Score

6^/10
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  
  Everything32.dll
- Size
  
  84KB
- MD5
  
  3b03324537327811bbbaff4aafa4d75b
- SHA1
  
  1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7
- SHA256
  
  8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
- SHA512
  
  ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62
- SSDEEP
  
  768:r7q2ysU1Jr1SHx6p73TpzkqVVWwupGKcrrbRkzOnORqhJtfwxnZRqFlP+YiXoyIZ:r7q2EJx+OVkqTIZerpnA2tfet7XJIZ
Score

1^/10
behavioral7 behavioral8
- Target
  
  sdel.exe
- Size
  
  350KB
- MD5
  
  803df907d936e08fbbd06020c411be93
- SHA1
  
  4aa4b498ae037a2b0479659374a5c3af5f6b8d97
- SHA256
  
  e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c
- SHA512
  
  5b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532
- SSDEEP
  
  6144:OBgL/kqXQangs2iKn5yvfj7wZxPzzLHrNJT7V:QgL5ga0iKn5GfPwZRT5
Score

1^/10
behavioral10 behavioral9
- Target
  
  sdel64.exe
- Size
  
  448KB
- MD5
  
  e2114b1627889b250c7fd0425ba1bd54
- SHA1
  
  97412dba3cbeb0125c71b7b2ab194ea2fdff51b2
- SHA256
  
  5434dfdb731238edcb07a8c3a83594791536dda7a63c29f19be7bb1d59aedd60
- SHA512
  
  76ca5f677bc8ee1485f3d5b028b3a91f74344e9ff7af3c62a98e737a9888bd35389b3e6bf7b8b67747e0f64e1c973c0708864f12de1388b95f5c31b4e084e2e1
- SSDEEP
  
  6144:cUudhn2yq9XzD0216Ta7CfqwbYs78LCA7uQUjRRMbq0gdyTwwFEbK1ldfI+niDNQ:czrnfqhDCqwbYs78LCA7qRMbq0ge3xg6
Score

1^/10
behavioral11 behavioral12