fog | 44b7eebf7a26d466f9c7ad4ddb058503f7066aded180ab6d5162197c47780293

General

Target
44b7eebf7a26d466f9c7ad4ddb058503f7066aded180ab6d5162197c47780293
Size 444KB
Sample260326-qrakdaf13m
SHA256 44b7eebf7a26d466f9c7ad4ddb058503f7066aded180ab6d5162197c47780293
MD5 be5af780a67635d1eae32bc959450aff
SHA1 57a544e97bdb613411b1d1d0b25b563c9d63fce4
SHA512 3524cf6e4cdfc7d85d4354ab9574b3c805557e9155d99858f90c59fe79b093341b212a3d408326157ca23e155e0e65eee274dc9301f7fe799bf9409e61ddcfc9
SSDEEP 12288:Z1se5TMrBYVsXRFd8bo/liIrEWuzrViA7uWSBwpPQE5H9y:Z1se5jsXRFd8aliIrEfrViAyf6QE5H9y
TLSH
T190A43A7FD6E8C22DE691803C52DAC3F06D69E6775C11078773A06EB0AA38BE19467713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\Common Files\microsoft shared\ink\ar-SA\readme.txt

fog

Ransom Note

If you are reading this, then you have been the victim of a cyber attack. We call ourselves Fog and we take responsibility for this incident. You can check out our blog where we post company data: xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion You might appear there if you opt out of our communication. We are the ones who encrypted your data and also copied some of it to our internal resource. The sooner you contact us, the sooner we can resolve this incident and get you back to work. To contact us you need to have Tor browser installed: 1. Follow this link: xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion 2. Enter the code: 1KQOWFH2KYTLDJKX7ZTJDNMX 3. Now we can communicate safely. If you are decision-maker, you will get all the details when you get in touch. We are waiting for you.

URLs

http://xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion
http://xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion

Targets

- Target
  44b7eebf7a26d466f9c7ad4ddb058503f7066aded180ab6d5162197c47780293
- Size 444KB
- SHA256 44b7eebf7a26d466f9c7ad4ddb058503f7066aded180ab6d5162197c47780293
- MD5 be5af780a67635d1eae32bc959450aff
- SHA1 57a544e97bdb613411b1d1d0b25b563c9d63fce4
- SHA512 3524cf6e4cdfc7d85d4354ab9574b3c805557e9155d99858f90c59fe79b093341b212a3d408326157ca23e155e0e65eee274dc9301f7fe799bf9409e61ddcfc9
- SSDEEP 12288:Z1se5TMrBYVsXRFd8bo/liIrEWuzrViA7uWSBwpPQE5H9y:Z1se5jsXRFd8aliIrEfrViAyf6QE5H9y
- TLSH
  T190A43A7FD6E8C22DE691803C52DAC3F06D69E6775C11078773A06EB0AA38BE19467713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution fog impact persistence privilege_escalation ransomware stealer
- Fog Ransomware
  Fog ransomware is used to attacks educational organizations and was first seen in the spring of 2024.
  ransomware fog
- Fog family
  fog
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (7769) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2