fog | cd3228f521e95f23279e611ec5c6506c814e474de4d3158891f6655d4c8834c1

General

Target
cd3228f521e95f23279e611ec5c6506c814e474de4d3158891f6655d4c8834c1
Size 153KB
Sample260812-m97q2scc22
SHA256 cd3228f521e95f23279e611ec5c6506c814e474de4d3158891f6655d4c8834c1
MD5 483a974f28e14c1d4221b7b3010f4c0f
SHA1 877f49f7fbfc4c48a5f7ab7bd5cd310a3c8e13e1
SHA512 1cbafb2cfd849d30a24ad14a91c680601f25af4c9f33704cd1db093fc8751f904cf677e02b68d0d135668047cdacaea6c00160f21175ff19a91d6ed8e9859353
SSDEEP 3072:Z6ie7XZgrpkEIg1WHCerB7KAqvIwPs0BafqLlMIRv9a2+oxBW:Z6r7XZgrpkE9mB7qvF1ASxvtdG
TLSH
T17DF32369A94DBDB55272F6D82A009E773EE3C5306C42B4F4121FD749A6C4838D22B7BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\Common Files\microsoft shared\ink\ar-SA\readme.txt

fog

Ransom Note

If you are reading this, then you have been the victim of a cyber attack. We call ourselves Fog and we take responsibility for this incident. You can check out our blog where we post company data: xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion You might appear there if you opt out of our communication. We are the ones who encrypted your data and also copied some of it to our internal resource. The sooner you contact us, the sooner we can resolve this incident and get you back to work. To contact us you need to have Tor browser installed: 1. Follow this link: xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion 2. Enter the code: 1KQOWFH2KYTLDJKX7ZTJDNMX 3. Now we can communicate safely. If you are decision-maker, you will get all the details when you get in touch. We are waiting for you.

URLs

http://xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion
http://xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion

Targets

- Target
  a9a4e89aaae8dc3638e3ca0f277ee37c0f3d14cd89f4972de591a531a6302fdd.exe
- Size 233KB
- SHA256 a9a4e89aaae8dc3638e3ca0f277ee37c0f3d14cd89f4972de591a531a6302fdd
- MD5 7b795e5db82f25b8261d70048b2c3940
- SHA1 3e47a924f8100582590b0e92b8342f394f01484f
- SHA512 f6bba416f6e2b6abdc7b0311ffeef9af85269606c09e00f0376926d380fdb771704264042c753d86d173bf26caf29b7082fc68971d89ad5cf076a4f7a562cc86
- SSDEEP 6144:jZey3YbbI1TQcUy4lxA8ari/dplVkT3kq:jNQI1TyyADar6G3
- TLSH
  T1D734CF41B4C183F9EA7A96B6A86CCFA46A2EF8740C109F4B53D205761E326D015BDCDF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution fog impact persistence privilege_escalation ransomware stealer
- Family: Fog Ransomware
  Fog ransomware is used to attacks educational organizations and was first seen in the spring of 2024.
  ransomware fog
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (7977) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Modifies Windows Firewall
  defense_evasion
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2