Overview

overview

10

Static

static

10

Synth Multi Tool.exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Synth Multi Tool.exe

  • Size

    373KB

  • Sample

    241219-p61vfatpdm

  • MD5

    db00217024581a4e0b46c11ab62bb7e6

  • SHA1

    54be254f9978ad728c1a8f7364cc527c4c4348a0

  • SHA256

    b970ee2d59035562b4594e6cac64255f38dc9708a8119b7f0d44af8c9ae81b78

  • SHA512

    167e50bdc4d0e854dd261670b64a96ae31e5fb33738363cee1a40cfae349794ceca67ebd462f02e166cec01e149da785af3af33433f162ea7a1d13ae75dab2c3

  • SSDEEP

    6144:Dr96+4vlljqensRnj9tZ1PiO3/UYwZJYX8CWooc/C5qhXK:xQlleensRn5b1PiO8YwZJYXkoocqqhXK

Score
10/10
chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\Documents\NOTE FROM THE HACKERS.txt

Ransom Note
All of your files have been encrypted with Military Grade Encryption. Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $300. Payment can be made in Solana only. RESTARTING your Computer will only spread the Virus even more Resulting in Even more Damages Making it impossible to Remove,So think Smart not Hard. How do I pay, where do I get Solana? Purchasing Solana varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Solana. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Kraken - hxxps://www.kraken.com Coinbase-hxxps.www.coinbase.com If you are Infected with This Virus you can Join the Live Room on Discord Using a Device that is not encrypted Such as your Mobile Device. hxxps://discord.gg/HM7wCBKe to Negotiate our payment plans. If link has expired Here is my Personal Account gaming_is_a_j0ke Payment informationAmount: 1.245664629 SOL Solana Address: 8aWZPFmHJ7JYXj4NQza8HxfvpotbG85Pi3Vvj1YHBaaF

Targets

    • Target

      Synth Multi Tool.exe

    • Size

      373KB

    • MD5

      db00217024581a4e0b46c11ab62bb7e6

    • SHA1

      54be254f9978ad728c1a8f7364cc527c4c4348a0

    • SHA256

      b970ee2d59035562b4594e6cac64255f38dc9708a8119b7f0d44af8c9ae81b78

    • SHA512

      167e50bdc4d0e854dd261670b64a96ae31e5fb33738363cee1a40cfae349794ceca67ebd462f02e166cec01e149da785af3af33433f162ea7a1d13ae75dab2c3

    • SSDEEP

      6144:Dr96+4vlljqensRnj9tZ1PiO3/UYwZJYX8CWooc/C5qhXK:xQlleensRn5b1PiO8YwZJYXkoocqqhXK

    Score
    10/10
    chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Chaos family

      chaos

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Renames multiple (199) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks