magniber | f3fff0e99b7e8c7a2d8988759f360dfd24b3e7108e4cba7691f40dacd7c310a3

General

Target

7f786f98ee0c469c2a7eb81cce8f44c6
Size

38KB
Sample

240129-lbrrhaefa6
MD5

7f786f98ee0c469c2a7eb81cce8f44c6
SHA1

e09daefa41183764a61e4a43704889cbb9172346
SHA256

f3fff0e99b7e8c7a2d8988759f360dfd24b3e7108e4cba7691f40dacd7c310a3
SHA512

039ed6272d95b73a4d6282326b1a26802ae271d005cc871911455f685ae7bfb7bb04ed0f7e30e4721331a6d5783248d12f91ab414df10608411a08bb2cabc431
SSDEEP

768:jVuj0qdq03H5RlWWLHM25c3IitrNo+3ZGMezaXNb5I6:jKZ3BHM2+wwGMezaHd

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://ecbc1228aa7c56d02ehxgpjnwi.hy5tprdl77synlgxroueyzpat4iszkkx52r4i3ufbg6l7b32zqkyc5ad.onion/hxgpjnwi Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://ecbc1228aa7c56d02ehxgpjnwi.metthe.top/hxgpjnwi http://ecbc1228aa7c56d02ehxgpjnwi.sameleg.site/hxgpjnwi http://ecbc1228aa7c56d02ehxgpjnwi.iflook.club/hxgpjnwi http://ecbc1228aa7c56d02ehxgpjnwi.keystwo.uno/hxgpjnwi Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://ecbc1228aa7c56d02ehxgpjnwi.hy5tprdl77synlgxroueyzpat4iszkkx52r4i3ufbg6l7b32zqkyc5ad.onion/hxgpjnwi

http://ecbc1228aa7c56d02ehxgpjnwi.metthe.top/hxgpjnwi

http://ecbc1228aa7c56d02ehxgpjnwi.sameleg.site/hxgpjnwi

http://ecbc1228aa7c56d02ehxgpjnwi.iflook.club/hxgpjnwi

http://ecbc1228aa7c56d02ehxgpjnwi.keystwo.uno/hxgpjnwi

Extracted

Path

C:\Users\Admin\Pictures\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://50389490e2ac8a302ahxgpjnwi.hy5tprdl77synlgxroueyzpat4iszkkx52r4i3ufbg6l7b32zqkyc5ad.onion/hxgpjnwi Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://50389490e2ac8a302ahxgpjnwi.metthe.top/hxgpjnwi http://50389490e2ac8a302ahxgpjnwi.sameleg.site/hxgpjnwi http://50389490e2ac8a302ahxgpjnwi.iflook.club/hxgpjnwi http://50389490e2ac8a302ahxgpjnwi.keystwo.uno/hxgpjnwi Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://50389490e2ac8a302ahxgpjnwi.hy5tprdl77synlgxroueyzpat4iszkkx52r4i3ufbg6l7b32zqkyc5ad.onion/hxgpjnwi

http://50389490e2ac8a302ahxgpjnwi.metthe.top/hxgpjnwi

http://50389490e2ac8a302ahxgpjnwi.sameleg.site/hxgpjnwi

http://50389490e2ac8a302ahxgpjnwi.iflook.club/hxgpjnwi

http://50389490e2ac8a302ahxgpjnwi.keystwo.uno/hxgpjnwi

Targets

- Target
  
  7f786f98ee0c469c2a7eb81cce8f44c6
- Size
  
  38KB
- MD5
  
  7f786f98ee0c469c2a7eb81cce8f44c6
- SHA1
  
  e09daefa41183764a61e4a43704889cbb9172346
- SHA256
  
  f3fff0e99b7e8c7a2d8988759f360dfd24b3e7108e4cba7691f40dacd7c310a3
- SHA512
  
  039ed6272d95b73a4d6282326b1a26802ae271d005cc871911455f685ae7bfb7bb04ed0f7e30e4721331a6d5783248d12f91ab414df10608411a08bb2cabc431
- SSDEEP
  
  768:jVuj0qdq03H5RlWWLHM25c3IitrNo+3ZGMezaXNb5I6:jKZ3BHM2+wwGMezaHd
Score

10^/10

magniber ransomware
- Detect magniber ransomware
- Magniber Ransomware
  Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
  ransomware magniber
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Renames multiple (69) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Suspicious use of SetThreadContext
behavioral1 behavioral2