Overview

overview

10

Static

static

10

EByteLocker-Built.exe

windows7-x64

1

EByteLocker-Built.exe

windows10-2004-x64

10

EByteLocker-Built.exe

windows10-ltsc_2021-x64

10

EByteLocker-Built.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    EByteLocker-Built.7z
  • Size 1.8MB
  • Sample250330-bancksym18
  • SHA256 7a1d47c880b81bb265771d3d90e4d126dccd9e5654cdccc5b2941bd9529e7aa0
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
ebyte_ransomwareexecutionransomware

Malware Config

Extracted

Family

  • ebyte_ransomware

C2

  • to/aes: counter overflowpend

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://i.imgur.com/zQ1ei8j.png

Extracted

Path

  • C:\Decryption Instructions.txt

Ransom Note
  • ---------- EByte Locker ---------- Your files have been encrypted using EByte Ransomware! They can only be decrypted by paying us a ransom in cryptocurrency. Encrypted files have the .EByteLocker extension. IMPORTANT: Do not modify or rename encrypted files, as they may become unrecoverable. Contact us at the following email address to discuss payment. [email protected] ---------- EByteLocker ----------

Targets

    • Target
      EByteLocker-Built.exe
    • Size 5.8MB
    • SHA256 08cf671756c4a333fe6fe40feb5707d048c576e0f701cacb38a466558c420acc
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    executionransomware

    • Renames multiple (191) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks