magniber | 9209b297a4d3af1a82e4a60fa45fa558f08a502ebcf5dc2fa487505fd72be331

General

Target

3088d9d808dd030a756633437f351b13
Size

33KB
Sample

231225-vxqwrsfag9
MD5

3088d9d808dd030a756633437f351b13
SHA1

a4e78428c7aa5f14681a313fd3f92c9267e9469a
SHA256

9209b297a4d3af1a82e4a60fa45fa558f08a502ebcf5dc2fa487505fd72be331
SHA512

2db4cc645b040f5e5e73d61db8342b40b5fd592ad96b5187d8513e5fd6864da6306ebc887b58df7ebf94f00aac703a3acfe30e326bd9bf7eec49a27276d75b70
SSDEEP

768:JxnHytUcpkucln36De22PJNFai4OLS5wz3YKUt4fSsDZ:J0DkVV6Dh2dHrdzrbNZ

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\readme.txt婍

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://70b064b89cc49020e6emkyhecy.yeipgu36oui5z4yvck5w6d252oo3h7ktcsxvs3m2wac6ezmti2iotzad.onion/emkyhecy Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://70b064b89cc49020e6emkyhecy.mixedon.xyz/emkyhecy http://70b064b89cc49020e6emkyhecy.actmake.site/emkyhecy http://70b064b89cc49020e6emkyhecy.spiteor.space/emkyhecy http://70b064b89cc49020e6emkyhecy.bearsat.space/emkyhecy Note! These are temporary addresses! They will be available for a limited amount of time! ?�

URLs

http://70b064b89cc49020e6emkyhecy.yeipgu36oui5z4yvck5w6d252oo3h7ktcsxvs3m2wac6ezmti2iotzad.onion/emkyhecy

http://70b064b89cc49020e6emkyhecy.mixedon.xyz/emkyhecy

http://70b064b89cc49020e6emkyhecy.actmake.site/emkyhecy

http://70b064b89cc49020e6emkyhecy.spiteor.space/emkyhecy

http://70b064b89cc49020e6emkyhecy.bearsat.space/emkyhecy

Extracted

Path

C:\Users\Admin\Pictures\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://7278d0001c94b63022emkyhecy.yeipgu36oui5z4yvck5w6d252oo3h7ktcsxvs3m2wac6ezmti2iotzad.onion/emkyhecy Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://7278d0001c94b63022emkyhecy.mixedon.xyz/emkyhecy http://7278d0001c94b63022emkyhecy.actmake.site/emkyhecy http://7278d0001c94b63022emkyhecy.spiteor.space/emkyhecy http://7278d0001c94b63022emkyhecy.bearsat.space/emkyhecy Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://7278d0001c94b63022emkyhecy.yeipgu36oui5z4yvck5w6d252oo3h7ktcsxvs3m2wac6ezmti2iotzad.onion/emkyhecy

http://7278d0001c94b63022emkyhecy.mixedon.xyz/emkyhecy

http://7278d0001c94b63022emkyhecy.actmake.site/emkyhecy

http://7278d0001c94b63022emkyhecy.spiteor.space/emkyhecy

http://7278d0001c94b63022emkyhecy.bearsat.space/emkyhecy

Targets

- Target
  
  3088d9d808dd030a756633437f351b13
- Size
  
  33KB
- MD5
  
  3088d9d808dd030a756633437f351b13
- SHA1
  
  a4e78428c7aa5f14681a313fd3f92c9267e9469a
- SHA256
  
  9209b297a4d3af1a82e4a60fa45fa558f08a502ebcf5dc2fa487505fd72be331
- SHA512
  
  2db4cc645b040f5e5e73d61db8342b40b5fd592ad96b5187d8513e5fd6864da6306ebc887b58df7ebf94f00aac703a3acfe30e326bd9bf7eec49a27276d75b70
- SSDEEP
  
  768:JxnHytUcpkucln36De22PJNFai4OLS5wz3YKUt4fSsDZ:J0DkVV6Dh2dHrdzrbNZ
Score

10^/10

magniber ransomware
- Detect magniber ransomware
- Magniber Ransomware
  Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
  ransomware magniber
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Renames multiple (66) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
behavioral1 behavioral2