fog | c9f910b3e1bda4565a6ca8833201d7f241cd3c6bb78c59f956965d1046a4b50e

General

Target
261114-b8a5xabx4s_pw_infected.zip
Size 154KB
Sample261114-cctstabx9t
SHA256 c9f910b3e1bda4565a6ca8833201d7f241cd3c6bb78c59f956965d1046a4b50e
MD5 ea7c04a7ca99febdcf2abf2d39085bf6
SHA1 f8147f191d9b2c4fb48ab9b3736db7ed67930463
SHA512 ef5b8758a98e670bc6a67f57b4069b88bf02142fa1a50f6ea06ad1f80d455e9359af5813fcd7bc7fc0416a79409643aca444a167eef5fba6c40f72151e75ab59
SSDEEP 3072:GbVbbKGQ9+uQ9Ik9n7+xFvdYvFvrcr9OujUfC2pnOXKq60SwD+BHApv9pT6:GRbbKGYAIq7+xBd2vrcr9OujhjKV0Swi
TLSH
T1D7F312CDBC46C7188D351E42FBFAD99617964928350243C2A4722332A22DE95B8FF573
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\Common Files\microsoft shared\ClickToRun\readme.txt

fog

Ransom Note

If you are reading this, then you have been the victim of a cyber attack. We call ourselves Fog and we take responsibility for this incident. You can check out our blog where we post company data: xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion You might appear there if you opt out of our communication. We are the ones who encrypted your data and also copied some of it to our internal resource. The sooner you contact us, the sooner we can resolve this incident and get you back to work. To contact us you need to have Tor browser installed: 1. Follow this link: xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion 2. Enter the code: 1KQOWFH2KYTLDJKX7ZTJDNMX 3. Now we can communicate safely. If you are decision-maker, you will get all the details when you get in touch. We are waiting for you.

URLs

http://xbkv2qey6u3gd3qxcojynrt4h5sgrhkar6whuo74wo63hijnn677jnyd.onion
http://xql562evsy7njcsngacphc2erzjfecwotdkobn3m4uxu2gtqh26newid.onion

Targets

- Target
  261114-b8a5xabx4s_pw_infected.zip
- Size 154KB
- SHA256 c9f910b3e1bda4565a6ca8833201d7f241cd3c6bb78c59f956965d1046a4b50e
- MD5 ea7c04a7ca99febdcf2abf2d39085bf6
- SHA1 f8147f191d9b2c4fb48ab9b3736db7ed67930463
- SHA512 ef5b8758a98e670bc6a67f57b4069b88bf02142fa1a50f6ea06ad1f80d455e9359af5813fcd7bc7fc0416a79409643aca444a167eef5fba6c40f72151e75ab59
- SSDEEP 3072:GbVbbKGQ9+uQ9Ik9n7+xFvdYvFvrcr9OujUfC2pnOXKq60SwD+BHApv9pT6:GRbbKGYAIq7+xBd2vrcr9OujhjKV0Swi
- TLSH
  T1D7F312CDBC46C7188D351E42FBFAD99617964928350243C2A4722332A22DE95B8FF573
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution fog impact persistence privilege_escalation ransomware stealer
- Family: Fog Ransomware
  Fog ransomware is used to attacks educational organizations and was first seen in the spring of 2024.
  ransomware fog
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (8096) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Queries Windows Firewall configuration
  Lists Windows Firewall rules and allowed ports on the host, showing which network traffic or programs can communicate without being blocked.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1