magniber | 27ccf224a002dfa52b238c36b894991ca8f0b40c0741383c56fa4c31dbdd5cba

General

Target

377ea8e8c63f2b19b07c69492e99f3d8_JaffaCakes118
Size

20KB
Sample

241012-aefmvs1hjb
MD5

377ea8e8c63f2b19b07c69492e99f3d8
SHA1

dbe31e03e08116a69e435b4e083722a9745e54bc
SHA256

27ccf224a002dfa52b238c36b894991ca8f0b40c0741383c56fa4c31dbdd5cba
SHA512

c90414add29ad621923d38bdc3464295525ad884e64d9686a092a80e829f35692e1fdadd0e925539c0e0151f476d70860f48cc6a60504243eb3d96190431f87c
SSDEEP

384:KGAfHlDSTBkbMlSykOMIPSo0RsClrRjp1Sw6knL7ZcnA6AcIdrVpXsx45Xwpo:SfFAqbMlSykOnN0RsOFp1Sw6oKAjcIdj

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://e68cc6b058b092c014qbvpseec.m647u2xsjtlfyzuevlxjiiwjsg2btyhmbxbjz4in4hm76u6hjzc62wad.onion/qbvpseec Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://e68cc6b058b092c014qbvpseec.gosmark.space/qbvpseec http://e68cc6b058b092c014qbvpseec.ourunit.xyz/qbvpseec http://e68cc6b058b092c014qbvpseec.topsaid.site/qbvpseec http://e68cc6b058b092c014qbvpseec.iecard.top/qbvpseec Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://e68cc6b058b092c014qbvpseec.m647u2xsjtlfyzuevlxjiiwjsg2btyhmbxbjz4in4hm76u6hjzc62wad.onion/qbvpseec

http://e68cc6b058b092c014qbvpseec.gosmark.space/qbvpseec

http://e68cc6b058b092c014qbvpseec.ourunit.xyz/qbvpseec

http://e68cc6b058b092c014qbvpseec.topsaid.site/qbvpseec

http://e68cc6b058b092c014qbvpseec.iecard.top/qbvpseec

Extracted

Path

C:\Users\Admin\Pictures\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://8224c89032284020bcqbvpseec.m647u2xsjtlfyzuevlxjiiwjsg2btyhmbxbjz4in4hm76u6hjzc62wad.onion/qbvpseec Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://8224c89032284020bcqbvpseec.gosmark.space/qbvpseec http://8224c89032284020bcqbvpseec.ourunit.xyz/qbvpseec http://8224c89032284020bcqbvpseec.topsaid.site/qbvpseec http://8224c89032284020bcqbvpseec.iecard.top/qbvpseec Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://8224c89032284020bcqbvpseec.m647u2xsjtlfyzuevlxjiiwjsg2btyhmbxbjz4in4hm76u6hjzc62wad.onion/qbvpseec

http://8224c89032284020bcqbvpseec.gosmark.space/qbvpseec

http://8224c89032284020bcqbvpseec.ourunit.xyz/qbvpseec

http://8224c89032284020bcqbvpseec.topsaid.site/qbvpseec

http://8224c89032284020bcqbvpseec.iecard.top/qbvpseec

Targets

- Target
  
  377ea8e8c63f2b19b07c69492e99f3d8_JaffaCakes118
- Size
  
  20KB
- MD5
  
  377ea8e8c63f2b19b07c69492e99f3d8
- SHA1
  
  dbe31e03e08116a69e435b4e083722a9745e54bc
- SHA256
  
  27ccf224a002dfa52b238c36b894991ca8f0b40c0741383c56fa4c31dbdd5cba
- SHA512
  
  c90414add29ad621923d38bdc3464295525ad884e64d9686a092a80e829f35692e1fdadd0e925539c0e0151f476d70860f48cc6a60504243eb3d96190431f87c
- SSDEEP
  
  384:KGAfHlDSTBkbMlSykOMIPSo0RsClrRjp1Sw6knL7ZcnA6AcIdrVpXsx45Xwpo:SfFAqbMlSykOnN0RsOFp1Sw6oKAjcIdj
Score

10^/10

magniber defense_evasion discovery execution impact ransomware
- Detect magniber ransomware
- Magniber Ransomware
  Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
  ransomware magniber
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (80) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
behavioral1 behavioral2