Overview

overview

10

Static

static

d0bd999fa2...c3.exe

windows7_x64

10

d0bd999fa2...c3.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    d0bd999fa299d848b8c9fb4ad274b0ec229dc21b70e347b9c6c5ba1110624bc3
  • Size 147KB
  • Sample210516-fsf76e5316
  • SHA256 d0bd999fa299d848b8c9fb4ad274b0ec229dc21b70e347b9c6c5ba1110624bc3
  • MD5 SHA1 SHA512
Score
10/10
seonransomwarespywarestealertrojan

Malware Config

Extracted

Path

  • C:\Users\Admin\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note
  • You became victim of the GOLDENEYE RANSOMWARE! The files on your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page shown in step 2. To purchase your key and restore your data, please follow these three easy steps: 1. Download the Tor Browser at "https://www.torproject.org/". If you need help, please google for "access onion page". 2. Visit one of the following pages with the Tor Browser: http://golden5a4eqranh7.onion/nfbduo7C http://goldeny4vs3nyoht.onion/nfbduo7C 3. Enter your personal decryption code there: nfbduo7CavppVqX1RUTgR9LwEwJcWbWZSLvdD1ECChZ14Wr5HWfRD21qPDvGTy2yEacXGUQKk8bKpivwpTPZGhk936V943nK
URLs

  • http://golden5a4eqranh7.onion/nfbduo7C

  • http://goldeny4vs3nyoht.onion/nfbduo7C

Extracted

Path

  • C:\Users\Admin\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note
  • You became victim of the GOLDENEYE RANSOMWARE! The files on your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page shown in step 2. To purchase your key and restore your data, please follow these three easy steps: 1. Download the Tor Browser at "https://www.torproject.org/". If you need help, please google for "access onion page". 2. Visit one of the following pages with the Tor Browser: http://golden5a4eqranh7.onion/xn7KdpFP http://goldeny4vs3nyoht.onion/xn7KdpFP 3. Enter your personal decryption code there: xn7KdpFPX7z25jLtRkTBvn4vrnMEfqz3LE8iCGSZuVKYHT8MQSPhhw4GDZFAhFxGx2dUMWEuJEz5Kh7REF1wnCjHfmYDwuwk
URLs

  • http://golden5a4eqranh7.onion/xn7KdpFP

  • http://goldeny4vs3nyoht.onion/xn7KdpFP

Targets

    • Target
      d0bd999fa299d848b8c9fb4ad274b0ec229dc21b70e347b9c6c5ba1110624bc3
    • Size 147KB
    • SHA256 d0bd999fa299d848b8c9fb4ad274b0ec229dc21b70e347b9c6c5ba1110624bc3
    • MD5 SHA1 SHA512
    Score
    10/10
    seonransomwarespywarestealertrojan

    • Seon

      The Seon Ransomware is an encryption ransomware Trojan first observed on November 14, 2018.

      trojanransomwareseon

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks