Overview

overview

10

Static

static

10

7za.exe

windows7-x64

1

Amigodainapasik.exe

windows7-x64

10

Everything.exe

windows7-x64

6

Everything32.dll

windows7-x64

1

sdel.exe

windows7-x64

1

sdel64.exe

windows7-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    virus-files(pass_virus).zip

  • Size

    15.8MB

  • Sample

    230815-k3e2cahh85

  • MD5

    0c11768d49cd22ebee5b6ad3d7febcd6

  • SHA1

    bb463da43458f7708aaea4931579503b067090d7

  • SHA256

    e231cc1fb99fcca6bae8df59470f82136cb97b9f9c96a75d8cf7ab2ad4e222a0

  • SHA512

    f440c98c762534e5203f0406c38185b164528df0a48296ee55eb5b7dd480f698023cbe95c663898dde6a2471970611055765f7b0dbb6cd127ee0516e45f9df59

  • SSDEEP

    393216:owy0YNUtmKdreI8t7pMRRdusbu6SxpQ0uCsmTAwG3z4:5y0w8d/8/CRhbu6Sxy0uH4

Score
10/10
mimicevasionpersistenceransomwaretrojan

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Amigodainapasik_Decryption.txt

Ransom Note
░██████╗░██████╗░███████╗███████╗████████╗██╗███╗░░██╗░██████╗░░██████╗  ███████╗██████╗░░█████╗░███╗░░░███╗ ██╔════╝░██╔══██╗██╔════╝██╔════╝╚══██╔══╝██║████╗░██║██╔════╝░██╔════╝  ██╔════╝██╔══██╗██╔══██╗████╗░████║ ██║░░██╗░██████╔╝█████╗░░█████╗░░░░░██║░░░██║██╔██╗██║██║░░██╗░╚█████╗░  █████╗░░██████╔╝██║░░██║██╔████╔██║ ██║░░╚██╗██╔══██╗██╔══╝░░██╔══╝░░░░░██║░░░██║██║╚████║██║░░╚██╗░╚═══██╗  ██╔══╝░░██╔══██╗██║░░██║██║╚██╔╝██║ ╚██████╔╝██║░░██║███████╗███████╗░░░██║░░░██║██║░╚███║╚██████╔╝██████╔╝  ██║░░░░░██║░░██║╚█████╔╝██║░╚═╝░██║ ░╚═════╝░╚═╝░░╚═╝╚══════╝╚══════╝░░░╚═╝░░░╚═╝╚═╝░░╚══╝░╚═════╝░╚═════╝░  ╚═╝░░░░░╚═╝░░╚═╝░╚════╝░╚═╝░░░░░╚═╝ ░█████╗░██╗░░░░░██████╗░░█████╗░███╗░░██╗██╗░█████╗░██╗ ██╔══██╗██║░░░░░██╔══██╗██╔══██╗████╗░██║██║██╔══██╗██║ ███████║██║░░░░░██████╦╝███████║██╔██╗██║██║███████║██║ ██╔══██║██║░░░░░██╔══██╗██╔══██║██║╚████║██║██╔══██║╚═╝ ██║░░██║███████╗██████╦╝██║░░██║██║░╚███║██║██║░░██║██╗ ╚═╝░░╚═╝╚══════╝╚═════╝░╚═╝░░╚═╝╚═╝░░╚══╝╚═╝╚═╝░░╚═╝╚═╝ -----------------------------[ Hello, My Dear Friend !!! ]-------------------------- ALL YOUR FILES HAVE BEEN ENCRYPTED DUE TO A SECURITY PROBLEM WITH YOUR PC. If you want to restore them : 1) Send your unique id dHJOfCXS8JAVmN4yRU_vHu0n1bAd8HeQ742rh-vfm28*an8uxv2w and max 3 files for test decryption OUR CONTACTS: 1.1) TOX messenger (fast and anonymous) https://tox.chat/download.html Install qtox Press sign up Create your own name Press plus Put there our tox ID: E9164A982410EFAEBC451C1D5629A2CBB75DBB6BCDBD6D2BA94F4D0A7B0B616F911496E469FB And add me/write message 1.2) ICQ Messenger ICQ live chat which works 24/7 - @Amigodainapasik Install ICQ software on your PC here https://icq.com/windows/ or on your smartphone search for "ICQ" in Appstore / Google market Write to our ICQ @Amigodainapasik https://icq.im/Amigodainapasik 1.3) Skype Amigodainapasik Decryption 1.4) Mail (write only in critical situations bcs your email may not be delivered or get in spam) * [email protected] In subject line please write your decryption ID: dHJOfCXS8JAVmN4yRU_vHu0n1bAd8HeQ742rh-vfm28*an8uxv2w You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. FREE DECRYPTION AS A GUARANTEE! Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 10Mb (non archived), and files should not contain valuable information. (databases, backups, large excel sheets, etc.) How to obtain Bitcoins: https://www.alfa.cash/buy-crypto-with-credit-card (the fastest way) buy.coingate.com https://bitcoin.org/en/buy https://buy.moonpay.io binance.com coinmama.com ATTENTION!!! Do not rename encrypted files! Do not try to decrypt your data using third party software, it may cause permanent data loss! Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you may become a victim of a scam!
URLs

https://tox.chat/download.html

https://icq.com/windows/

https://icq.im/Amigodainapasik

https://www.alfa.cash/buy-crypto-with-credit-card

Targets

    • Target

      7za.exe

    • Size

      772KB

    • MD5

      b93eb0a48c91a53bda6a1a074a4b431e

    • SHA1

      ac693a14c697b1a8ee80318e260e817b8ee2aa86

    • SHA256

      ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142

    • SHA512

      732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5

    • SSDEEP

      24576:DFhjj7f4K+ao308d0ORMz27R0iIdclDJiD:JlwpP90OFWxD

    Score
    1/10
    behavioral1

    • Target

      Amigodainapasik.exe

    • Size

      2.3MB

    • MD5

      0da0f742cf3bd80919716fbd03299189

    • SHA1

      0ff0f5254e399aa2d487dd7f0dec032a3429f257

    • SHA256

      8f8ce3e99d843a4beb1d3d961a7cab27e75e32490132464e448bdbcd97ddcfd5

    • SHA512

      ce92c93973120a2808b7b33c20324f450b1e33aa1637fd2a66bc3c8f56cd44ec492e71cd8e34eb807c6cbfc5e356332b487144168de531be787ebb75ee3778f3

    • SSDEEP

      49152:ohBJrWt7Yfg1evewmI874ZtPttM/G/jOayrdDKr:ohBJrWF04RIu4Zfa3rdOr

    Score
    10/10
    mimicevasionpersistenceransomwaretrojan

    • Detects Mimic ransomware

    • Mimic

      Ransomware family was first exploited in the wild in 2022.

      ransomwaremimic

    • UAC bypass

      evasiontrojan

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Renames multiple (5797) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Deletes System State backups

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Sets file execution options in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral2

    • Target

      Everything.exe

    • Size

      1.7MB

    • MD5

      c44487ce1827ce26ac4699432d15b42a

    • SHA1

      8434080fad778057a50607364fee8b481f0feef8

    • SHA256

      4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

    • SHA512

      a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

    • SSDEEP

      49152:sVzyP4BTkT3EApTLi2CCzMn3jzjAhFEy+eaXr:sVzyABTwEH

    Score
    6/10

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral3

    • Target

      Everything32.dll

    • Size

      84KB

    • MD5

      3b03324537327811bbbaff4aafa4d75b

    • SHA1

      1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7

    • SHA256

      8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880

    • SHA512

      ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62

    • SSDEEP

      768:r7q2ysU1Jr1SHx6p73TpzkqVVWwupGKcrrbRkzOnORqhJtfwxnZRqFlP+YiXoyIZ:r7q2EJx+OVkqTIZerpnA2tfet7XJIZ

    Score
    1/10
    behavioral4

    • Target

      sdel.exe

    • Size

      350KB

    • MD5

      803df907d936e08fbbd06020c411be93

    • SHA1

      4aa4b498ae037a2b0479659374a5c3af5f6b8d97

    • SHA256

      e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c

    • SHA512

      5b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532

    • SSDEEP

      6144:OBgL/kqXQangs2iKn5yvfj7wZxPzzLHrNJT7V:QgL5ga0iKn5GfPwZRT5

    Score
    1/10
    behavioral5

    • Target

      sdel64.exe

    • Size

      448KB

    • MD5

      e2114b1627889b250c7fd0425ba1bd54

    • SHA1

      97412dba3cbeb0125c71b7b2ab194ea2fdff51b2

    • SHA256

      5434dfdb731238edcb07a8c3a83594791536dda7a63c29f19be7bb1d59aedd60

    • SHA512

      76ca5f677bc8ee1485f3d5b028b3a91f74344e9ff7af3c62a98e737a9888bd35389b3e6bf7b8b67747e0f64e1c973c0708864f12de1388b95f5c31b4e084e2e1

    • SSDEEP

      6144:cUudhn2yq9XzD0216Ta7CfqwbYs78LCA7uQUjRRMbq0gdyTwwFEbK1ldfI+niDNQ:czrnfqhDCqwbYs78LCA7qRMbq0ge3xg6

    Score
    1/10
    behavioral6

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Modify Registry

5
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

3
T1490

Tasks