Overview

overview

10

Static

static

10

e90bdaaf5f...27.exe

windows10-1703-x64

10

Resubmissions

15/01/2024, 10:33

240115-mln9sseben10

30/01/2023, 02:12

230130-cnc97seh7x10

Sharing

Copy URL Twitter E-mail

General

  • Target
    e90bdaaf5f9ca900133b699f18e4062562148169b29cb4eb37a0577388c22527.zip
  • Size 741KB
  • Sample240115-mln9sseben
  • SHA256 fca69729e8052caad11c59e1ec5b7671bb1898724b3a1316ad77c8e565c85795
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
agendaransomware

Malware Config

Extracted

Family

  • agenda

Attributes
  • company_id

    MmXReVIxLV

  • note

    -- Qilin Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from you system/network If you refuse to communicate with us and we do not come to an agreementyour data will be published. Data includes: - Employees personal dataCVsDLSSN. - Complete network map including credentials for local and remote services. - Financial information including clients databillsbudgetsannual reportsbank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials -- Credentials Extension: MmXReVIxLV Domain: ueegj65kwr3v3sjhli73gjtmfnh2uqlte3vyg2kkyqq7cja2yx2ptaad.onion login: 6f031ccd-526a-4806-82a8-2e7d926243d4 password:

rsa_pubkey.plain

Extracted

Path

  • C:\Users\README-RECOVER-MmXReVIxLV.txt

  • agenda

Ransom Note
  • -- Qilin Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from you system/network If you refuse to communicate with us and we do not come to an agreementyour data will be published. Data includes: - Employees personal dataCVsDLSSN. - Complete network map including credentials for local and remote services. - Financial information including clients databillsbudgetsannual reportsbank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials -- Credentials Extension: MmXReVIxLV Domain: ueegj65kwr3v3sjhli73gjtmfnh2uqlte3vyg2kkyqq7cja2yx2ptaad.onion login: 6f031ccd-526a-4806-82a8-2e7d926243d4 password: AgendaPass
URLs

  • http://ueegj65kwr3v3sjhli73gjtmfnh2uqlte3vyg2kkyqq7cja2yx2ptaad.onion

Targets

    • Target
      e90bdaaf5f9ca900133b699f18e4062562148169b29cb4eb37a0577388c22527.exe
    • Size 1.6MB
    • SHA256 e90bdaaf5f9ca900133b699f18e4062562148169b29cb4eb37a0577388c22527
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    agendaransomware

    • Agenda Ransomware

      A ransomware with multiple variants written in Golang and Rust first seen in August 2022.

      ransomwareagenda

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Renames multiple (152) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks