Overview

overview

10

Static

static

181e0c4ab2...28.exe

windows7_x64

10

181e0c4ab2...28.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    181e0c4ab2474bb337e349da7ed87fcb5ff87949768dca0a70855e0e499f4728

  • Size

    147KB

  • Sample

    210515-1y1a9rkgrs

  • MD5

    c13ef7d75bea7e8ca137e721b67f6e09

  • SHA1

    6f0806f831c8ba09a2ea5752267d0239f5299302

  • SHA256

    181e0c4ab2474bb337e349da7ed87fcb5ff87949768dca0a70855e0e499f4728

  • SHA512

    cb1cf7077c91dcbe22b80fdbcae7e46d44533247e34896b91f6854e5bc4eb1741b0a0a3d5b24f6d0680759bebe733c68c3dc0401d331f331d352d063468ed53c

Score
10/10
seonransomwarespywarestealertrojan

Malware Config

Extracted

Path

C:\Users\Admin\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note
You became victim of the GOLDENEYE RANSOMWARE! The files on your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page shown in step 2. To purchase your key and restore your data, please follow these three easy steps: 1. Download the Tor Browser at "https://www.torproject.org/". If you need help, please google for "access onion page". 2. Visit one of the following pages with the Tor Browser: http://golden5a4eqranh7.onion/wCHNxPBZ http://goldeny4vs3nyoht.onion/wCHNxPBZ 3. Enter your personal decryption code there: wCHNxPBZKVBnnJonWQMwBgRzDAWs5HiHGVkS4y4g9JYP6YJDLu6qpp6mzwz6X6mhTzXpPGX6NNJRJz62tZf8GqWvGEnuW3ic
URLs

http://golden5a4eqranh7.onion/wCHNxPBZ

http://goldeny4vs3nyoht.onion/wCHNxPBZ

Extracted

Path

C:\Users\Admin\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note
You became victim of the GOLDENEYE RANSOMWARE! The files on your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page shown in step 2. To purchase your key and restore your data, please follow these three easy steps: 1. Download the Tor Browser at "https://www.torproject.org/". If you need help, please google for "access onion page". 2. Visit one of the following pages with the Tor Browser: http://golden5a4eqranh7.onion/t7yfCKJc http://goldeny4vs3nyoht.onion/t7yfCKJc 3. Enter your personal decryption code there: t7yfCKJc78YkeNUN9XeucVMKTGmpXwTK2Aq66rMq17usJTETZ1zJMgSaQzKJigjPpa7R81iemEeDerY1WXpC1QRoqMWjvjBC
URLs

http://golden5a4eqranh7.onion/t7yfCKJc

http://goldeny4vs3nyoht.onion/t7yfCKJc

Targets

    • Target

      181e0c4ab2474bb337e349da7ed87fcb5ff87949768dca0a70855e0e499f4728

    • Size

      147KB

    • MD5

      c13ef7d75bea7e8ca137e721b67f6e09

    • SHA1

      6f0806f831c8ba09a2ea5752267d0239f5299302

    • SHA256

      181e0c4ab2474bb337e349da7ed87fcb5ff87949768dca0a70855e0e499f4728

    • SHA512

      cb1cf7077c91dcbe22b80fdbcae7e46d44533247e34896b91f6854e5bc4eb1741b0a0a3d5b24f6d0680759bebe733c68c3dc0401d331f331d352d063468ed53c

    Score
    10/10
    seonransomwarespywarestealertrojan

    • Seon

      The Seon Ransomware is an encryption ransomware Trojan first observed on November 14, 2018.

      trojanransomwareseon

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks