Overview

overview

10

Static

static

10

d786355c1b...f6.exe

windows10-2004-x64

10

Resubmissions

28/05/2026, 07:29

260528-ja71zsbs2z10

09/05/2021, 14:15

210509-wme1e6v4r610

Sharing

Copy URL Twitter E-mail

General

  • Target
    d786355c1b3dc741103873aed46d8ffa3430d113a27482f37f3ffc7c978747f6.bin
  • Size 123KB
  • Sample260528-ja71zsbs2z
  • SHA256 d786355c1b3dc741103873aed46d8ffa3430d113a27482f37f3ffc7c978747f6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
fuxsocycredential_accessdefense_evasiondiscoverypersistenceprivilege_escalationransomwarestealer

Malware Config

Extracted

Path

  • C:\Program Files\Common Files\System\ja-JP\e1f9873915c0d10c___READ_THIS___e1f9873915c0d10c.txt

Ransom Note
  • ATTENTION! All your files documents, photos, databases and other important files are encrypted by FuxSocy encryptor. The only method of recovering files is to purchase a private key. It is on our server and only we can recover your files. 1. Visit https://tox.chat/download.html 2. Download and install qTOX on your PC. 3. Open it, click "New Profile" and create profile. 4. Click "Add friends" button and search our contact - AD049F565435C774D2A7D0A96FC2CC2E4AB5D6B860AEB52F2B1F6A01BB2682104F1361981FDE The alternative way to contact as is to use Jabber: 1. Visit https://psi-im.org/download/ 2. Download and install Psi on your PC. 3. Register new account on https://thesecure.biz:5281/register/new 4. Add new account in Psi. 5. Add our contact - [email protected] If you have problems to contact us via TOX and JABBER - send message to our email address [email protected] or [email protected] This communication method is VERY UNRELIABLE, use it only as a last resort. If you have not received an answer within 12 hours - try again or write to TOX or JABBER. In message please write your ID and wait our answer: e1f9873915c0d10c Please note, this is time limited offer. You have about 7 days to contact us - after Jun 05 your private key will be deleted automatically and there will be no ways to get your files back. DO NOT try to recover your files by yourself, it may damage your data.
URLs

  • https://tox.chat/download.html

  • https://psi-im.org/download/

  • https://thesecure.biz:5281/register/new

Targets

    • Target
      d786355c1b3dc741103873aed46d8ffa3430d113a27482f37f3ffc7c978747f6.bin
    • Size 123KB
    • SHA256 d786355c1b3dc741103873aed46d8ffa3430d113a27482f37f3ffc7c978747f6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    credential_accessdefense_evasiondiscoveryfuxsocypersistenceprivilege_escalationransomwarestealer

    • Detects FuxSocy family

    • Family: FuxSocy

      FuxSocy is a Windows ransomware written in C++.

      ransomwarefuxsocy

    • Modifies security service

      defense_evasion

    • Modifies visibility of hidden/system files in Explorer

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Accessibility Features

1
T1546.008

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Accessibility Features

1
T1546.008

Defense Evasion

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Modify Registry

3
T1112

Subvert Trust Controls

1
T1553

SIP and Trust Provider Hijacking

1
T1553.003

Credential Access

Credentials from Password Stores

1
T1555

Windows Credential Manager

1
T1555.004

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

2
T1012

Remote System Discovery

1
T1018

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks