Overview

overview

10

Static

static

3

a9a4e89aaa...dd.exe

windows11-ltsc_2024-x64

10

Resubmissions

14/11/2026, 01:48

261114-b8a5xabx4s10

12/08/2026, 11:10

260812-m97q2scc2210

Sharing

Copy URL Twitter E-mail

General

  • Target
    cd3228f521e95f23279e611ec5c6506c814e474de4d3158891f6655d4c8834c1
  • Size 153KB
  • Sample261114-b8a5xabx4s
  • SHA256 cd3228f521e95f23279e611ec5c6506c814e474de4d3158891f6655d4c8834c1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
fogdiscoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Extracted

Path

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\readme.txt

  • fog

Ransom Note
  • If you are reading this, then you have been the victim of a cyber attack. We call ourselves Fog and we take responsibility for this incident. You can check out our blog where we post company data: xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion You might appear there if you opt out of our communication. We are the ones who encrypted your data and also copied some of it to our internal resource. The sooner you contact us, the sooner we can resolve this incident and get you back to work. To contact us you need to have Tor browser installed: 1. Follow this link: xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion 2. Enter the code: 1KQOWFH2KYTLDJKX7ZTJDNMX 3. Now we can communicate safely. If you are decision-maker, you will get all the details when you get in touch. We are waiting for you.
URLs

  • http://xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion

  • http://xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion

Targets

    • Target
      a9a4e89aaae8dc3638e3ca0f277ee37c0f3d14cd89f4972de591a531a6302fdd.exe
    • Size 233KB
    • SHA256 a9a4e89aaae8dc3638e3ca0f277ee37c0f3d14cd89f4972de591a531a6302fdd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryexecutionfogpersistenceprivilege_escalationransomware

    • Family: Fog Ransomware

      Fog ransomware is used to attacks educational organizations and was first seen in the spring of 2024.

      ransomwarefog

    • Renames multiple (6881) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Queries Windows Firewall configuration

      Lists Windows Firewall rules and allowed ports on the host, showing which network traffic or programs can communicate without being blocked.

      discovery

    • Network Service Discovery

      Attempt to gather information on host's network.

      discovery

    • Discovers running processes

      Running process information can be used to identify security tools or plan follow-on actions.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks