Overview

overview

10

Static

static

3

a239735cdd...18.exe

windows7-x64

10

a239735cdd...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a239735cddd49236ae3562d43d83a8e4_JaffaCakes118

  • Size

    2.4MB

  • Sample

    240612-za2rzaygma

  • MD5

    a239735cddd49236ae3562d43d83a8e4

  • SHA1

    35bad8d66c79af9dabdcdd8dcebfc0440efc42a1

  • SHA256

    cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c

  • SHA512

    34bbfc20d82c4227f9e745f0f7cdb5ce68c684a4a84cde0340fa82601f9340fcb7d21c6060564be8580dcba8c3d1b5a16b28ab6964508e0d1ab994b59a818fef

  • SSDEEP

    49152:czlsjR3QZgRWsu1s8thudV3HGSQFsBL55:Q2aiRWs+1Uo2

Score
10/10
smaugransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\HACKED.txt

Family

smaug

Ransom Note
Your files have been encrypted using military grade encryption. They can never be accessed again without buying a decryption key. You can buy the decryption key at http://smaugrwmaystthfxp72tlmdbrzlwdp2pxtpvtzvhkv5ppg3difiwonad.onion. To access the site you need Tor Browser. Download tor browser here - https://www.torproject.org/download/ . Once you download enter url in tor browser. If you do not know how to buy bitcoin here are options-. https://www.coinbase.com/ , https://paxful.com/ , https://changelly.com/ , or locate a bitcoin ATM like https://www.bitcoindepot.com/ . If you dont buy decryption key or make threats then we will auction your data , passwords, documents, files, ip,router,company server details, along with decryption key via an darkweb auction to highest bidder.,We stay in business because we honor our word. upon payment All your data will remain confidential, and not leaked.
URLs

http://smaugrwmaystthfxp72tlmdbrzlwdp2pxtpvtzvhkv5ppg3difiwonad.onion

https://paxful.com/

https://changelly.com/

https://www.bitcoindepot.com/

Targets

    • Target

      a239735cddd49236ae3562d43d83a8e4_JaffaCakes118

    • Size

      2.4MB

    • MD5

      a239735cddd49236ae3562d43d83a8e4

    • SHA1

      35bad8d66c79af9dabdcdd8dcebfc0440efc42a1

    • SHA256

      cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c

    • SHA512

      34bbfc20d82c4227f9e745f0f7cdb5ce68c684a4a84cde0340fa82601f9340fcb7d21c6060564be8580dcba8c3d1b5a16b28ab6964508e0d1ab994b59a818fef

    • SSDEEP

      49152:czlsjR3QZgRWsu1s8thudV3HGSQFsBL55:Q2aiRWs+1Uo2

    Score
    10/10
    smaugransomwarespywarestealer

    • Smaug

      Ransomware-as-a-service first seen marketed on forums etc. in early 2020.

      ransomwaresmaug

    • Drops file in Drivers directory

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks