Resubmissions

15/01/2024, 10:33

240115-mln9sseben10

30/01/2023, 02:12

230130-cnc97seh7x10

General

  • Target
    e90bdaaf5f9ca900133b699f18e4062562148169b29cb4eb37a0577388c22527.zip
  • Size 741KB
  • Sample230130-cnc97seh7x
  • SHA256 fca69729e8052caad11c59e1ec5b7671bb1898724b3a1316ad77c8e565c85795
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10

Malware Config

Extracted

Family
  • agenda

Attributes
  • company_id

    MmXReVIxLV

  • note

    -- Qilin Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from you system/network If you refuse to communicate with us and we do not come to an agreementyour data will be published. Data includes: - Employees personal dataCVsDLSSN. - Complete network map including credentials for local and remote services. - Financial information including clients databillsbudgetsannual reportsbank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials -- Credentials Extension: MmXReVIxLV Domain: ueegj65kwr3v3sjhli73gjtmfnh2uqlte3vyg2kkyqq7cja2yx2ptaad.onion login: 6f031ccd-526a-4806-82a8-2e7d926243d4 password:

rsa_pubkey.plain

Signatures

File Explorer

  • e90bdaaf5f9ca900133b699f18e4062562148169b29cb4eb37a0577388c22527.zip
    .zip 741KB
  • e90bdaaf5f9ca900133b699f18e4062562148169b29cb4eb37a0577388c22527.exe
    .exe 1.6MB

e90bdaaf5f9ca900133b699f18e4062562148169b29cb4eb37a0577388c22527.zip

  • SHA256 fca69729e8052caad11c59e1ec5b7671bb1898724b3a1316ad77c8e565c85795
  • MD5 SHA1 SHA512 SSDEEP
Password
infected