Overview

overview

10

Static

static

10

8CDD2FE599...4A.exe

windows10-2004-x64

8CDD2FE599...4A.exe

windows11-21h2-x64

10

Resubmissions

08/04/2025, 14:01

250408-rb2vcsvpt510

08/04/2025, 09:09

250408-k4fn9ssnv710

08/04/2025, 09:04

250408-k1xhlssnt910

Sharing

Copy URL Twitter E-mail

General

  • Target
    WannaBitcoin.7z
  • Size 219KB
  • Sample250408-rb2vcsvpt5
  • SHA256 5727c532a044cf9fc05d38e0f1f3762b56aa2cc99ed24ad2656245af813f8779
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
mafiaware666bootkitdiscoverypersistenceransomware

Malware Config

Targets

    • Target
      8CDD2FE5990836816361CE46CCE780A56B70456AE2B4C6595FCB6CC2601C754A.exe
    • Size 12.3MB
    • SHA256 8cdd2fe5990836816361ce46cce780a56b70456ae2b4c6595fcb6cc2601c754a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    mafiaware666bootkitdiscoverypersistenceransomware

    • Detect MafiaWare666 ransomware

    • MafiaWare666 Ransomware

      MafiaWare666 is ransomware written in C# with multiple variants.

      ransomwaremafiaware666

    • Mafiaware666 family

      mafiaware666

    • Renames multiple (108) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks