magniber | 7ceec3030c119c0b32adf031494a95eaa53d74205a1db89788ad5ced0220af4f

General

Target

aa07b96ab22c192c74f703b5df686c0e
Size

38KB
Sample

240227-yn9t3aac7t
MD5

aa07b96ab22c192c74f703b5df686c0e
SHA1

127443fe311a7f4d6a6823ebceee705865d9a14f
SHA256

7ceec3030c119c0b32adf031494a95eaa53d74205a1db89788ad5ced0220af4f
SHA512

aef837180cd8aa69426fbbd530b27dd6630f8f2cc1b3a1b84a55aab335df44fb8ef54a5f5bb1a82663e29b034eaf7204a8adfa818edfe1525bd1b2c5c3fcee98
SSDEEP

768:RjWwU9acnUuAMU24OIPDG02NLMCaYr/Dwy2ycKi/+hw:RS7kcTfmGhNAFOsjKi+

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\readme.txt婍

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://103c22302aa4f8e050gtpiaqekj.ntjflrx6uhwcmfhnn3yewv2wfhtqtjyfkvyrvjz4wuo6uw33yw7sfiid.onion/gtpiaqekj Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://103c22302aa4f8e050gtpiaqekj.bitslet.uno/gtpiaqekj http://103c22302aa4f8e050gtpiaqekj.flymet.club/gtpiaqekj http://103c22302aa4f8e050gtpiaqekj.canyour.xyz/gtpiaqekj http://103c22302aa4f8e050gtpiaqekj.dogper.space/gtpiaqekj Note! These are temporary addresses! They will be available for a limited amount of time! ?�

URLs

http://103c22302aa4f8e050gtpiaqekj.ntjflrx6uhwcmfhnn3yewv2wfhtqtjyfkvyrvjz4wuo6uw33yw7sfiid.onion/gtpiaqekj

http://103c22302aa4f8e050gtpiaqekj.bitslet.uno/gtpiaqekj

http://103c22302aa4f8e050gtpiaqekj.flymet.club/gtpiaqekj

http://103c22302aa4f8e050gtpiaqekj.canyour.xyz/gtpiaqekj

http://103c22302aa4f8e050gtpiaqekj.dogper.space/gtpiaqekj

Extracted

Path

C:\Users\Admin\Music\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://103c22302aa4f8e050gtpiaqekj.ntjflrx6uhwcmfhnn3yewv2wfhtqtjyfkvyrvjz4wuo6uw33yw7sfiid.onion/gtpiaqekj Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://103c22302aa4f8e050gtpiaqekj.bitslet.uno/gtpiaqekj http://103c22302aa4f8e050gtpiaqekj.flymet.club/gtpiaqekj http://103c22302aa4f8e050gtpiaqekj.canyour.xyz/gtpiaqekj http://103c22302aa4f8e050gtpiaqekj.dogper.space/gtpiaqekj Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://103c22302aa4f8e050gtpiaqekj.ntjflrx6uhwcmfhnn3yewv2wfhtqtjyfkvyrvjz4wuo6uw33yw7sfiid.onion/gtpiaqekj

http://103c22302aa4f8e050gtpiaqekj.bitslet.uno/gtpiaqekj

http://103c22302aa4f8e050gtpiaqekj.flymet.club/gtpiaqekj

http://103c22302aa4f8e050gtpiaqekj.canyour.xyz/gtpiaqekj

http://103c22302aa4f8e050gtpiaqekj.dogper.space/gtpiaqekj

Targets

- Target
  
  aa07b96ab22c192c74f703b5df686c0e
- Size
  
  38KB
- MD5
  
  aa07b96ab22c192c74f703b5df686c0e
- SHA1
  
  127443fe311a7f4d6a6823ebceee705865d9a14f
- SHA256
  
  7ceec3030c119c0b32adf031494a95eaa53d74205a1db89788ad5ced0220af4f
- SHA512
  
  aef837180cd8aa69426fbbd530b27dd6630f8f2cc1b3a1b84a55aab335df44fb8ef54a5f5bb1a82663e29b034eaf7204a8adfa818edfe1525bd1b2c5c3fcee98
- SSDEEP
  
  768:RjWwU9acnUuAMU24OIPDG02NLMCaYr/Dwy2ycKi/+hw:RS7kcTfmGhNAFOsjKi+
Score

10^/10

magniber ransomware
- Detect magniber ransomware
- Magniber Ransomware
  Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
  ransomware magniber
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Renames multiple (82) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Suspicious use of SetThreadContext
behavioral1 behavioral2