Overview

overview

10

Static

static

3

GHOST FUD CRYPTER.exe

windows10-2004-x64

10

GHOST FUD CRYPTER.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    GHOST FUD CRYPTER.exe
  • Size 9.5MB
  • Sample260824-aefymabe93
  • SHA256 339a880408b453df07d35dba3979144b2cee3a778bc3906e52d1b72acaf5b045
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasionpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\ransomNOTE.txt

Ransom Note
  • Hi! All your files are encrypted. -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised, rebooting/shutdown will cause you to lose files whitout the possibility of recovery and even god will not be able to help you, it could be files on the network belonging to other users, sure you want to take that responsibility? -- Our encryption algorithms are very strong and your files are very well protected, you can't hope to recover them whitout paying the ransom. The only way to get your files back is to follow the 4 steps below. As soon as the ransom will be paid, you will see the decryptor program on the Desktop folder. Do not try to recover your files whitout a decrypt program, you may damage them and then they will be impossible to recover. (If you dont know how to, just search it on YouTube, like How to download Exodus) 1.Download Exodus 2.Get some Bitcoin for 300$ (in USD) 3.Swap Bitcon to Monero 4.Send the Monero to this address: 4BKcz4x1tJg7Tqr2nKJ1Ug2totBBP54E9F8UkY79vK8nQaShnzFtPr872s6jGV3TRPMAGzrZdBG7UMa3XFar4fg49eHDw9W -- Oh, and if you decide you dont want to pay or take too much time, well all your files, and information we know about you WILL be transfered to the FBI. We are NOT joking, hurry up with the decision.

Targets

    • Target
      GHOST FUD CRYPTER.exe
    • Size 9.5MB
    • SHA256 339a880408b453df07d35dba3979144b2cee3a778bc3906e52d1b72acaf5b045
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    credential_accessdefense_evasionpersistenceprivilege_escalationransomwarespywarestealer

    • Creates a file in the Startup directory

      A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

      persistenceprivilege_escalation

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Hide Artifacts: Hidden Files and Directories

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks