Overview

overview

10

Static

static

a6ea8e6e28...4f.exe

windows7_x64

10

a6ea8e6e28...4f.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a6ea8e6e28f95bc4fb4adf76204c1566b08a6f50a74babffa4af2711d3ce964f

  • Size

    146KB

  • Sample

    210515-5fky1zvz9j

  • MD5

    bea1fce2d104e411f955626ff42cd19c

  • SHA1

    952871073d5229b6e0e80ad3d86afd36a422f220

  • SHA256

    a6ea8e6e28f95bc4fb4adf76204c1566b08a6f50a74babffa4af2711d3ce964f

  • SHA512

    a7312bed3c6abd56694291d34d89fb2cb453fcba169a01fe3569cff1459e3c2f15ec1436280cc7b391bce9a57dac4d68aeef9112db0d2edc1860629a438b36ec

Score
10/10
seonransomwarespywarestealertrojan

Malware Config

Extracted

Path

C:\Users\Admin\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note
You became victim of the GOLDENEYE RANSOMWARE! The files on your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page shown in step 2. To purchase your key and restore your data, please follow these three easy steps: 1. Download the Tor Browser at "https://www.torproject.org/". If you need help, please google for "access onion page". 2. Visit one of the following pages with the Tor Browser: http://golden5a4eqranh7.onion/xG7bMrhZ http://goldeny4vs3nyoht.onion/xG7bMrhZ 3. Enter your personal decryption code there: xG7bMrhZTjGREATczk4jR8u7pNzhqfZ3evchsDa5CXghamGsGAwnK9ri292ojAoxh6p3cZdMnMv9X4F56Z8hjnk6f63ThMUR
URLs

http://golden5a4eqranh7.onion/xG7bMrhZ

http://goldeny4vs3nyoht.onion/xG7bMrhZ

Extracted

Path

C:\Users\Admin\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note
You became victim of the GOLDENEYE RANSOMWARE! The files on your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page shown in step 2. To purchase your key and restore your data, please follow these three easy steps: 1. Download the Tor Browser at "https://www.torproject.org/". If you need help, please google for "access onion page". 2. Visit one of the following pages with the Tor Browser: http://golden5a4eqranh7.onion/rHJe5KmQ http://goldeny4vs3nyoht.onion/rHJe5KmQ 3. Enter your personal decryption code there: rHJe5KmQKKKGX9zXN5bvFFGrkoJwKofeyYUXpkb11CDcRpVF4QwpLVtt7RfUk6d92dD4p15HX7fjezeZ1JRk9oVMooCAahQ2
URLs

http://golden5a4eqranh7.onion/rHJe5KmQ

http://goldeny4vs3nyoht.onion/rHJe5KmQ

Targets

    • Target

      a6ea8e6e28f95bc4fb4adf76204c1566b08a6f50a74babffa4af2711d3ce964f

    • Size

      146KB

    • MD5

      bea1fce2d104e411f955626ff42cd19c

    • SHA1

      952871073d5229b6e0e80ad3d86afd36a422f220

    • SHA256

      a6ea8e6e28f95bc4fb4adf76204c1566b08a6f50a74babffa4af2711d3ce964f

    • SHA512

      a7312bed3c6abd56694291d34d89fb2cb453fcba169a01fe3569cff1459e3c2f15ec1436280cc7b391bce9a57dac4d68aeef9112db0d2edc1860629a438b36ec

    Score
    10/10
    seonransomwarespywarestealertrojan

    • Seon

      The Seon Ransomware is an encryption ransomware Trojan first observed on November 14, 2018.

      trojanransomwareseon

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks