Overview

overview

10

Static

static

fec02d2f54...67.exe

windows7_x64

10

fec02d2f54...67.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fec02d2f54f1d7421f44ad9cafe2649259e144dc5fcb5bc88a52943362e5b267

  • Size

    147KB

  • Sample

    210515-2slh2qpedn

  • MD5

    c3d390ed9736f3b0e358d25132f0170e

  • SHA1

    1d9ba08d7cc917287c52540e173f4ddcc34566be

  • SHA256

    fec02d2f54f1d7421f44ad9cafe2649259e144dc5fcb5bc88a52943362e5b267

  • SHA512

    5221a2e3dc5324ca553383b4d4621f13b74f8d5cefa29fa4bdcfd448e7092d70ddf63d943f42d525971325f738a8b6bda6afa2af14803e4dbd4fe7478c9a4eed

Score
10/10
seonransomwarespywarestealertrojan

Malware Config

Extracted

Path

C:\Users\Admin\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note
You became victim of the GOLDENEYE RANSOMWARE! The files on your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page shown in step 2. To purchase your key and restore your data, please follow these three easy steps: 1. Download the Tor Browser at "https://www.torproject.org/". If you need help, please google for "access onion page". 2. Visit one of the following pages with the Tor Browser: http://golden5a4eqranh7.onion/nTv99py2 http://goldeny4vs3nyoht.onion/nTv99py2 3. Enter your personal decryption code there: nTv99py2KuFGuCdrC4sLfAA88xdTETLyf8MA82aucHjZJUYa4wojhacScprpdmvFEZ6NwKbw6dwMnMdPBKjRpLgZ2woh2Czy
URLs

http://golden5a4eqranh7.onion/nTv99py2

http://goldeny4vs3nyoht.onion/nTv99py2

Extracted

Path

C:\Users\Admin\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note
You became victim of the GOLDENEYE RANSOMWARE! The files on your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page shown in step 2. To purchase your key and restore your data, please follow these three easy steps: 1. Download the Tor Browser at "https://www.torproject.org/". If you need help, please google for "access onion page". 2. Visit one of the following pages with the Tor Browser: http://golden5a4eqranh7.onion/rmTHYwcP http://goldeny4vs3nyoht.onion/rmTHYwcP 3. Enter your personal decryption code there: rmTHYwcPm7FWar376EjDSkDgGb226tohJm2ovZXw2povL7V5WzTP1p6uLJsMwH95gu2VsgnFMNg59r6F4SAQr2SNcwcvnGpV
URLs

http://golden5a4eqranh7.onion/rmTHYwcP

http://goldeny4vs3nyoht.onion/rmTHYwcP

Targets

    • Target

      fec02d2f54f1d7421f44ad9cafe2649259e144dc5fcb5bc88a52943362e5b267

    • Size

      147KB

    • MD5

      c3d390ed9736f3b0e358d25132f0170e

    • SHA1

      1d9ba08d7cc917287c52540e173f4ddcc34566be

    • SHA256

      fec02d2f54f1d7421f44ad9cafe2649259e144dc5fcb5bc88a52943362e5b267

    • SHA512

      5221a2e3dc5324ca553383b4d4621f13b74f8d5cefa29fa4bdcfd448e7092d70ddf63d943f42d525971325f738a8b6bda6afa2af14803e4dbd4fe7478c9a4eed

    Score
    10/10
    seonransomwarespywarestealertrojan

    • Seon

      The Seon Ransomware is an encryption ransomware Trojan first observed on November 14, 2018.

      trojanransomwareseon

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks