Overview

overview

10

Static

static

10

EByteLocker-Built.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    EByteLocker-Built.exe
  • Size 5.8MB
  • Sample250520-zkrpracm2x
  • SHA256 01ba293ce5892cc4c45a9cbd46062660e16d44ba65daf2d05df0221e2a32fee5
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
ebyte_ransomwareexecutionransomware

Malware Config

Extracted

Family

  • ebyte_ransomware

C2

  • tacknewproc1: new g is not G

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://i.imgur.com/zQ1ei8j.png

Extracted

Path

  • C:\Decryption Instructions.txt

Ransom Note
  • ---------- EByte Locker ---------- Your files have been encrypted using EByte Ransomware! They can only be decrypted by paying us a ransom in cryptocurrency. Encrypted files have the .EByteLocker extension. IMPORTANT: Do not modify or rename encrypted files, as they may become unrecoverable. Contact us at the following email address to discuss payment. [email protected] ---------- EByteLocker ----------

Targets

    • Target
      EByteLocker-Built.exe
    • Size 5.8MB
    • SHA256 01ba293ce5892cc4c45a9cbd46062660e16d44ba65daf2d05df0221e2a32fee5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    executionransomware

    • Renames multiple (187) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks