fog | 113a06c8ba6069d345f3c3db89051553d8aff7d27408945b50aa94256277dcb3

General

Target
2025-05-05_76de8233ac93ff3b5fac843df8ae90ac_amadey_black-basta_darkgate_elex_luca-stealer
Size 444KB
Sample250505-ewjs3ayzav
SHA256 113a06c8ba6069d345f3c3db89051553d8aff7d27408945b50aa94256277dcb3
MD5 76de8233ac93ff3b5fac843df8ae90ac
SHA1 3a1df69dd75cf14b3378a9b7b573cc423fd3747b
SHA512 3d145b0cb78f0c795cb56033a3e480752bf23a2f0167c4c694f245821b9c0f8d838f42cc6d888087953e69c4a63b12227621f4e7ed85d580885f9b8a18c4658a
SSDEEP 12288:Z1se5TMrBYVsXRFd8bo/liIrEWuzrViA7uWSBwpPQE5H9y:Z1se5jsXRFd8aliIrEfrViAyf6QE5H9y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\Common Files\DESIGNER\readme.txt

fog

Ransom Note

If you are reading this, then you have been the victim of a cyber attack. We call ourselves Fog and we take responsibility for this incident. You can check out our blog where we post company data: xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion You might appear there if you opt out of our communication. We are the ones who encrypted your data and also copied some of it to our internal resource. The sooner you contact us, the sooner we can resolve this incident and get you back to work. To contact us you need to have Tor browser installed: 1. Follow this link: xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion 2. Enter the code: 1KQOWFH2KYTLDJKX7ZTJDNMX 3. Now we can communicate safely. If you are decision-maker, you will get all the details when you get in touch. We are waiting for you.

URLs

http://xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion
http://xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion

Targets

- Target
  2025-05-05_76de8233ac93ff3b5fac843df8ae90ac_amadey_black-basta_darkgate_elex_luca-stealer
- Size 444KB
- SHA256 113a06c8ba6069d345f3c3db89051553d8aff7d27408945b50aa94256277dcb3
- MD5 76de8233ac93ff3b5fac843df8ae90ac
- SHA1 3a1df69dd75cf14b3378a9b7b573cc423fd3747b
- SHA512 3d145b0cb78f0c795cb56033a3e480752bf23a2f0167c4c694f245821b9c0f8d838f42cc6d888087953e69c4a63b12227621f4e7ed85d580885f9b8a18c4658a
- SSDEEP 12288:Z1se5TMrBYVsXRFd8bo/liIrEWuzrViA7uWSBwpPQE5H9y:Z1se5jsXRFd8aliIrEfrViAyf6QE5H9y
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

fog credential_access defense_evasion discovery execution impact persistence privilege_escalation ransomware stealer
- Fog Ransomware
  Fog ransomware is used to attacks educational organizations and was first seen in the spring of 2024.
  ransomware fog
- Fog family
  fog
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (7496) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2