magniber | 064998d1e0e34525fd5a5d4dd384adc77ba752ee2256e1d0d2bdbb197a64de9c

General

Target

JaffaCakes118_a2478cf8d1c823fb8ccf323692b23121
Size

38KB
Sample

250108-qw3fystrfq
MD5

a2478cf8d1c823fb8ccf323692b23121
SHA1

088017b775533223ce21686de37f351337e43401
SHA256

064998d1e0e34525fd5a5d4dd384adc77ba752ee2256e1d0d2bdbb197a64de9c
SHA512

6082f709957d9fd026d4fff7a98dc77b4a337986f5754899f641165316d36eae4060c92f7122b813ea89aa1ad527cb55debe01e55621eba8b5d4f574ffb56ff7
SSDEEP

768:BsLGs0M9c39PH14ax7Gmaz6XDYHMeyyvXKGz6NfS3/UYuGjo4g7VpMm8Wl:BsLGs0AcRH1hx7GmazMDbeNfKGz6NK3c

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://c4302668ba001c1034wajxnjkw.r4vwwgioac7x2ftfglttr7qst265edv6rhmsdmjdgt6wxzuhgx4ynfid.onion/wajxnjkw Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://c4302668ba001c1034wajxnjkw.lessmod.quest/wajxnjkw http://c4302668ba001c1034wajxnjkw.fixkeys.top/wajxnjkw http://c4302668ba001c1034wajxnjkw.phoneis.website/wajxnjkw http://c4302668ba001c1034wajxnjkw.donehim.space/wajxnjkw Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://c4302668ba001c1034wajxnjkw.r4vwwgioac7x2ftfglttr7qst265edv6rhmsdmjdgt6wxzuhgx4ynfid.onion/wajxnjkw

http://c4302668ba001c1034wajxnjkw.lessmod.quest/wajxnjkw

http://c4302668ba001c1034wajxnjkw.fixkeys.top/wajxnjkw

http://c4302668ba001c1034wajxnjkw.phoneis.website/wajxnjkw

http://c4302668ba001c1034wajxnjkw.donehim.space/wajxnjkw

Extracted

Path

C:\Users\Admin\Pictures\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://f0ac20783a3426500wajxnjkw.r4vwwgioac7x2ftfglttr7qst265edv6rhmsdmjdgt6wxzuhgx4ynfid.onion/wajxnjkw Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://f0ac20783a3426500wajxnjkw.lessmod.quest/wajxnjkw http://f0ac20783a3426500wajxnjkw.fixkeys.top/wajxnjkw http://f0ac20783a3426500wajxnjkw.phoneis.website/wajxnjkw http://f0ac20783a3426500wajxnjkw.donehim.space/wajxnjkw Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://f0ac20783a3426500wajxnjkw.r4vwwgioac7x2ftfglttr7qst265edv6rhmsdmjdgt6wxzuhgx4ynfid.onion/wajxnjkw

http://f0ac20783a3426500wajxnjkw.lessmod.quest/wajxnjkw

http://f0ac20783a3426500wajxnjkw.fixkeys.top/wajxnjkw

http://f0ac20783a3426500wajxnjkw.phoneis.website/wajxnjkw

http://f0ac20783a3426500wajxnjkw.donehim.space/wajxnjkw

Targets

- Target
  
  JaffaCakes118_a2478cf8d1c823fb8ccf323692b23121
- Size
  
  38KB
- MD5
  
  a2478cf8d1c823fb8ccf323692b23121
- SHA1
  
  088017b775533223ce21686de37f351337e43401
- SHA256
  
  064998d1e0e34525fd5a5d4dd384adc77ba752ee2256e1d0d2bdbb197a64de9c
- SHA512
  
  6082f709957d9fd026d4fff7a98dc77b4a337986f5754899f641165316d36eae4060c92f7122b813ea89aa1ad527cb55debe01e55621eba8b5d4f574ffb56ff7
- SSDEEP
  
  768:BsLGs0M9c39PH14ax7Gmaz6XDYHMeyyvXKGz6NfS3/UYuGjo4g7VpMm8Wl:BsLGs0AcRH1hx7GmazMDbeNfKGz6NK3c
Score

10^/10

magniber defense_evasion discovery execution impact ransomware
- Detect magniber ransomware
- Magniber Ransomware
  Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
  ransomware magniber
- Magniber family
  magniber
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (82) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Suspicious use of SetThreadContext
behavioral1 behavioral2