magniber | 2cd5879589f6af26488a2c9451d279306c472302375916e34f2646e7095ce4b9

General

Target

cbf762fb16cfe0149b46a61f3fb029fd
Size

38KB
Sample

231228-hanfxaacd3
MD5

cbf762fb16cfe0149b46a61f3fb029fd
SHA1

24d70407e12631bd83f39164bcd5ca6a74a0b459
SHA256

2cd5879589f6af26488a2c9451d279306c472302375916e34f2646e7095ce4b9
SHA512

e26dd9fcb24b7357da2230c87d6ee7ed59f1288118160b42d92161a42e77a91077a8a9c6b9ab49a68f6cdf7135d57be3a465190118112d1c0a49e7408b28a853
SSDEEP

768:tNB4vRN8egwET/AOBHR9T7lGFDZFpVNKu90lQtwPFhXB+6OPvF65IM0:5A8ugn5T7le1l1Gb+6OPvdM

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\readme.txt婍

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://12d014b07e301ec08cawbcrke.grv4f55lyxu36y26o4orfzy7vmwiljcruko6r7q4tatxvjugg4j66lid.onion/awbcrke Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://12d014b07e301ec08cawbcrke.hegame.xyz/awbcrke http://12d014b07e301ec08cawbcrke.tietill.space/awbcrke http://12d014b07e301ec08cawbcrke.hesmust.top/awbcrke http://12d014b07e301ec08cawbcrke.salecup.club/awbcrke Note! These are temporary addresses! They will be available for a limited amount of time! ?�

URLs

http://12d014b07e301ec08cawbcrke.grv4f55lyxu36y26o4orfzy7vmwiljcruko6r7q4tatxvjugg4j66lid.onion/awbcrke

http://12d014b07e301ec08cawbcrke.hegame.xyz/awbcrke

http://12d014b07e301ec08cawbcrke.tietill.space/awbcrke

http://12d014b07e301ec08cawbcrke.hesmust.top/awbcrke

http://12d014b07e301ec08cawbcrke.salecup.club/awbcrke

Extracted

Path

C:\Users\Admin\Pictures\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://4604a6b87eac8a3024awbcrke.grv4f55lyxu36y26o4orfzy7vmwiljcruko6r7q4tatxvjugg4j66lid.onion/awbcrke Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://4604a6b87eac8a3024awbcrke.hegame.xyz/awbcrke http://4604a6b87eac8a3024awbcrke.tietill.space/awbcrke http://4604a6b87eac8a3024awbcrke.hesmust.top/awbcrke http://4604a6b87eac8a3024awbcrke.salecup.club/awbcrke Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://4604a6b87eac8a3024awbcrke.grv4f55lyxu36y26o4orfzy7vmwiljcruko6r7q4tatxvjugg4j66lid.onion/awbcrke

http://4604a6b87eac8a3024awbcrke.hegame.xyz/awbcrke

http://4604a6b87eac8a3024awbcrke.tietill.space/awbcrke

http://4604a6b87eac8a3024awbcrke.hesmust.top/awbcrke

http://4604a6b87eac8a3024awbcrke.salecup.club/awbcrke

Targets

- Target
  
  cbf762fb16cfe0149b46a61f3fb029fd
- Size
  
  38KB
- MD5
  
  cbf762fb16cfe0149b46a61f3fb029fd
- SHA1
  
  24d70407e12631bd83f39164bcd5ca6a74a0b459
- SHA256
  
  2cd5879589f6af26488a2c9451d279306c472302375916e34f2646e7095ce4b9
- SHA512
  
  e26dd9fcb24b7357da2230c87d6ee7ed59f1288118160b42d92161a42e77a91077a8a9c6b9ab49a68f6cdf7135d57be3a465190118112d1c0a49e7408b28a853
- SSDEEP
  
  768:tNB4vRN8egwET/AOBHR9T7lGFDZFpVNKu90lQtwPFhXB+6OPvF65IM0:5A8ugn5T7le1l1Gb+6OPvdM
Score

10^/10

magniber ransomware
- Detect magniber ransomware
- Magniber Ransomware
  Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
  ransomware magniber
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Renames multiple (98) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2