Overview

overview

10

Static

static

3

l.exe

windows10-2004-x64

10

l.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    infected.zip
  • Size 59KB
  • Sample251013-xnnfdshr7t
  • SHA256 fa0f043bb9f700063a5dc388322de207e08b53886b4112a5cb0bab26d5ee91aa
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
fogdefense_evasiondiscoverypersistenceprivilege_escalationransomware

Malware Config

Extracted

Path

  • C:\Program Files\Common Files\DESIGNER\readme.txt

  • fog

Ransom Note
  • If you are reading this, then you have been the victim of a cyber attack. We call ourselves Fog and we take responsibility for this incident. You can check out our blog where we post company data: xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion You might appear there if you opt out of our communication. We are the ones who encrypted your data and also copied some of it to our internal resource. The sooner you contact us, the sooner we can resolve this incident and get you back to work. To contact us you need to have Tor browser installed: 1. Follow this link: xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion 2. Enter the code: 58XMS26R7R3D031KKJH0HA7N 3. Now we can communicate safely. If you are decision-maker, you will get all the details when you get in touch. We are waiting for you.
URLs

  • http://xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion

  • http://xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion

Targets

    • Target
      l.exe
    • Size 103KB
    • SHA256 b6c1ee0c0a7b9a88d6cffaf90c950b7e0e96a841cc3e37c5242f6bff2a1c8202
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoveryfogpersistenceprivilege_escalationransomware

    • Fog Ransomware

      Fog ransomware is used to attacks educational organizations and was first seen in the spring of 2024.

      ransomwarefog

    • Fog family

      fog

    • Renames multiple (1774) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Modifies Windows Firewall

      defense_evasion

    • Network Service Discovery

      Attempt to gather information on host's network.

      discovery

    • Enumerates processes with tasklist

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks