Overview

overview

10

Static

static

1c1768c6fa...le.exe

windows7_x64

10

1c1768c6fa...le.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1c1768c6fa0a08f053da6a0dedd5cff04471eddb02b4934f280c1d78d61076fe.sample

  • Size

    150KB

  • Sample

    210726-thj1jl16ne

  • MD5

    a60b3d8e48f36a9084658fa35a03247e

  • SHA1

    a69e8d4a4f6904d1604d77a0eabf224a8421cc0e

  • SHA256

    1c1768c6fa0a08f053da6a0dedd5cff04471eddb02b4934f280c1d78d61076fe

  • SHA512

    d36c5e354bf22a21e52ada0d747418e223a343a14c4bc68e9dad0ac0dbca15e2ad82b395b9fc5792bc3eb673fd3efd5c1b4796b13cdfb99bd0600fca75b83678

Score
10/10
seonransomwarespywarestealertrojan

Malware Config

Extracted

Path

C:\Users\Admin\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note
You became victim of the GOLDENEYE RANSOMWARE! The files on your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page shown in step 2. To purchase your key and restore your data, please follow these three easy steps: 1. Download the Tor Browser at "https://www.torproject.org/". If you need help, please google for "access onion page". 2. Visit one of the following pages with the Tor Browser: http://golden5a4eqranh7.onion/spgHwwjo http://goldeny4vs3nyoht.onion/spgHwwjo 3. Enter your personal decryption code there: spgHwwjoT58uNtJY3KcBeiB8WdZtbGiq7hmwwpFodxGB4Aznd3bYuvongsim1QMhe5mDyiFzQfZUGRvXt9rS9pzKVUD4GrPQ
URLs

http://golden5a4eqranh7.onion/spgHwwjo

http://goldeny4vs3nyoht.onion/spgHwwjo

Extracted

Path

C:\Users\Admin\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note
You became victim of the GOLDENEYE RANSOMWARE! The files on your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page shown in step 2. To purchase your key and restore your data, please follow these three easy steps: 1. Download the Tor Browser at "https://www.torproject.org/". If you need help, please google for "access onion page". 2. Visit one of the following pages with the Tor Browser: http://golden5a4eqranh7.onion/xZ4abKxo http://goldeny4vs3nyoht.onion/xZ4abKxo 3. Enter your personal decryption code there: xZ4abKxoxi9yKYYBbCTukHCAs2HaJsrJfheRVjaUWmxdyceKe8tu9yjb19kRWGL9xDbxwxKFkT2qFSwqFXrJ8i4Aum3CeEP2
URLs

http://golden5a4eqranh7.onion/xZ4abKxo

http://goldeny4vs3nyoht.onion/xZ4abKxo

Targets

    • Target

      1c1768c6fa0a08f053da6a0dedd5cff04471eddb02b4934f280c1d78d61076fe.sample

    • Size

      150KB

    • MD5

      a60b3d8e48f36a9084658fa35a03247e

    • SHA1

      a69e8d4a4f6904d1604d77a0eabf224a8421cc0e

    • SHA256

      1c1768c6fa0a08f053da6a0dedd5cff04471eddb02b4934f280c1d78d61076fe

    • SHA512

      d36c5e354bf22a21e52ada0d747418e223a343a14c4bc68e9dad0ac0dbca15e2ad82b395b9fc5792bc3eb673fd3efd5c1b4796b13cdfb99bd0600fca75b83678

    Score
    10/10
    seonransomwarespywarestealertrojan

    • Seon

      The Seon Ransomware is an encryption ransomware Trojan first observed on November 14, 2018.

      trojanransomwareseon

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks