Overview

overview

10

Static

static

10

a205f79405...22.exe

windows10-2004-x64

10

a205f79405...22.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    a205f794058c59a19322debb1e96a6133ebbab01cb57ae159c2ddb3c7e97a922.bin
  • Size 5.8MB
  • Sample260207-aap1qsgy6h
  • SHA256 a205f794058c59a19322debb1e96a6133ebbab01cb57ae159c2ddb3c7e97a922
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
ebyte_ransomwareexecutionransomware

Malware Config

Extracted

Family

  • ebyte_ransomware

C2

  • http://localhost:8080/launch

secp256k1.publickey

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://i.imgur.com/vu5qS42.png

Extracted

Path

  • C:\Decryption Instructions.txt

Ransom Note
  • ---------- Zero Day Locker ---------- Your files have been encrypted using Zero Day Ransomware! They can only be decrypted by paying us a ransom in cryptocurrency. Encrypted files have the .zeroday extension. IMPORTANT: Do not modify or rename encrypted files, as they may become unrecoverable. Contact us at the following telegram contact to discuss payment. .me/praiukiu6 ---------- ZeroDayLocker ----------

Targets

    • Target
      a205f794058c59a19322debb1e96a6133ebbab01cb57ae159c2ddb3c7e97a922.bin
    • Size 5.8MB
    • SHA256 a205f794058c59a19322debb1e96a6133ebbab01cb57ae159c2ddb3c7e97a922
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    executionransomware

    • Renames multiple (186) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks