5ace35adeb360b9e165e7c55065d12f192a3ec0ca601dd73b332bd8cd68d51fe

General

Target
big_massive_gibbon.exe
Size 3.1MB
Sample230814-tbmfsadc35
SHA256 5ace35adeb360b9e165e7c55065d12f192a3ec0ca601dd73b332bd8cd68d51fe
MD5 0466d2952a01e41b5f8025e7f7c1e122
SHA1 93be3c1f4ee7b10660083a5632857d773571c2d0
SHA512 79639ae371de6da4eb3034201b74e04423d7b536334a21b9fd5720abec9dc69467bd09c0b5fc0d44a5c639c2220470116c98933e922a557bd3fdebaa70f6917a
SSDEEP 24576:8OSqHo/1S1q4W86JCjiwxg1NBFSFoBy4w42auPA0XOs6itD8K:8OzHoMABFCjiw21NnSGw42rD6it/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Users\How To Restore Your Files.txt

Ransom Note

All your documents, company files, images, etc (and there are a lot of company data) have been encrypted and the extension has been changed to .knight_l . The recovery is only possible with our help. US $5000 in Bitcoin is the price for restoring all of your data. This is the average monthly wage for 1 employee in your company. So don't even think about negotiating. That would only be a waste of time and you will be ignored. Send the Bitcoin to this wallet:14JJfrWQbud8c8KECHyc9jM6dammyjUb3Z (This is your only payment address, please don't pay BTC to other than this or you won't be able to get it decrypted!) After completing the Bitcoin transaction, send an email at: http://knightv5pdwrrfyxghivy3qccxxghk2yfyfigur562gcnmpmgd4pgfid.onion/61bdb5da-68f8-4255-94a5-1a8ea26ac989/ (Download and install TOR Browser (https://www.torproject.org/).[If you don't know how to use it, do a Google search!]).You will get an answer as soon as possible. I expect a message from you with the transfer of BTC Confirmation (TXID). So we can move forward to decrypt all your data. TXID is very important because it will help us identify your payment and connect it to your encrypted data.Do not use that I am here to waste mine or your time. How to buy the BTC? https://www.binance.com/en/how-to-buy/bitcoin https://www.coinbase.com/how-to-buy/bitcoin Note: Your data are uploaded to our servers before being encrypted, Everything related to your business (customer data, POS Data, documents related to your orders and delivery, and others). If you do not contact us and do not confirm the payment within 4 days, we will move forward and will announce the sales of the extracted data. ID:84bb8384f6d85225194a6ec6b9d21ca4e9d781fb946b409a83060ddc0b771b5b

URLs

http://knightv5pdwrrfyxghivy3qccxxghk2yfyfigur562gcnmpmgd4pgfid.onion/61bdb5da-68f8-4255-94a5-1a8ea26ac989/
https://www.binance.com/en/how-to-buy/bitcoin

Targets

- Target
  big_massive_gibbon.exe
- Size 3.1MB
- SHA256 5ace35adeb360b9e165e7c55065d12f192a3ec0ca601dd73b332bd8cd68d51fe
- MD5 0466d2952a01e41b5f8025e7f7c1e122
- SHA1 93be3c1f4ee7b10660083a5632857d773571c2d0
- SHA512 79639ae371de6da4eb3034201b74e04423d7b536334a21b9fd5720abec9dc69467bd09c0b5fc0d44a5c639c2220470116c98933e922a557bd3fdebaa70f6917a
- SSDEEP 24576:8OSqHo/1S1q4W86JCjiwxg1NBFSFoBy4w42auPA0XOs6itD8K:8OzHoMABFCjiw21NnSGw42rD6it/
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

ransomware
- Renames multiple (154) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2