Overview

overview

10

Static

static

10

0225a30270...24.exe

windows10-1703-x64

3

0225a30270...24.exe

windows7-x64

7

0225a30270...24.exe

windows10-2004-x64

3

0225a30270...24.exe

windows11-21h2-x64

3

05072a7ec4...7f.exe

windows10-1703-x64

10

05072a7ec4...7f.exe

windows7-x64

10

05072a7ec4...7f.exe

windows10-2004-x64

10

05072a7ec4...7f.exe

windows11-21h2-x64

10

1fca1cd049...77.exe

windows10-1703-x64

1

1fca1cd049...77.exe

windows7-x64

1

1fca1cd049...77.exe

windows10-2004-x64

1

1fca1cd049...77.exe

windows11-21h2-x64

1

20bab94e6d...52.exe

windows10-1703-x64

1

20bab94e6d...52.exe

windows7-x64

1

20bab94e6d...52.exe

windows10-2004-x64

1

20bab94e6d...52.exe

windows11-21h2-x64

1

2704e269fb...66.exe

windows10-1703-x64

10

2704e269fb...66.exe

windows7-x64

10

2704e269fb...66.exe

windows10-2004-x64

10

2704e269fb...66.exe

windows11-21h2-x64

10

2cbb3497bf...2d.dll

windows10-1703-x64

10

2cbb3497bf...2d.dll

windows7-x64

10

2cbb3497bf...2d.dll

windows10-2004-x64

10

2cbb3497bf...2d.dll

windows11-21h2-x64

10

37546b811e...f6.exe

windows10-1703-x64

10

37546b811e...f6.exe

windows7-x64

10

37546b811e...f6.exe

windows10-2004-x64

10

37546b811e...f6.exe

windows11-21h2-x64

10

49d828087c...2d.exe

windows10-1703-x64

1

49d828087c...2d.exe

windows7-x64

1

49d828087c...2d.exe

windows10-2004-x64

1

49d828087c...2d.exe

windows11-21h2-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Desktop.zip

  • Size

    14.2MB

  • MD5

    a5ecde14c94b30dea5ad15347b436243

  • SHA1

    ecf42b21df9d3e240f4acb0f145ccd23d2b2a36f

  • SHA256

    99cb0f92c60d88aadbb3e821f277ab51f6d8861c202cc1e16bb9ff0da10348a9

  • SHA512

    e78dbfaf4fd23fe3d7811b884002fc19f380e4aa451ac389da5433621738ba89ecacff62c408fe82f07c1fe4edfafe785b890a55b67934dcf814f33df89f4678

  • SSDEEP

    393216:84DICqy0qRoFk0fTyf7VdVcBIqs7BmT/3zu2C3WB:8Btnk0fWfZoBIq2B6HC3G

Score
10/10
agendayanluowang

Malware Config

Extracted

Family

agenda

Attributes
  • company_id

    gBBQsRxAcQ

  • note

    -- Qilin Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from you system/network If you refuse to communicate with us and we do not come to an agreementyour data will be published. Data includes: - Employees personal dataCVsDLSSN. - Complete network map including credentials for local and remote services. - Financial information including clients databillsbudgetsannual reportsbank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials -- Credentials Extension: gBBQsRxAcQ Domain: ru3q4ftbaqmpobhamqlnseorxywhhmqwhzx4pv4sqaacqz4m2ptleiid.onion login: 2200ffdb-68c4-43ed-83d8-52fe9d4d7a03 password:

rsa_pubkey.plain

Signatures

  • Agenda family
    agenda
  • Detects Yanluowang ransomware 1 IoCs
  • Yanluowang family
    yanluowang
  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

Files

  • Desktop.zip
    .zip
  • 0225a30270e5361e410453d4fb0501eb759612f6048ad43591b559d835720224.7z
    .7z

    Password: infected

  • 0225a30270e5361e410453d4fb0501eb759612f6048ad43591b559d835720224
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f.7z
    .7z

    Password: infected

  • 05072a7ec455fdf0977f69d49dcaaf012c403c9d39861fa2216eae19c160527f
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 1fca1cd04992e0fcaa714d9dfa97323d81d7e3d43a024ec37d1c7a2767a17577.7z
    .7z

    Password: infected

  • 1fca1cd04992e0fcaa714d9dfa97323d81d7e3d43a024ec37d1c7a2767a17577
    .exe windows:5 windows x64 arch:x64


    Headers

    Sections

  • 20bab94e6d9c8ed4832ce3b58f9150b16f9e5f40ffdcb747e10366cab5a30352.7z
    .7z

    Password: infected

  • 20bab94e6d9c8ed4832ce3b58f9150b16f9e5f40ffdcb747e10366cab5a30352
    .exe windows:6 windows x64 arch:x64

    9cbefe68f395e67356e2a5d8d1b285c0


    Headers

    Imports

    Sections

  • 2704e269fb5cf9a02070a0ea07d82dc9d87f2cb95e60cb71d6c6d38b01869f66.7z
    .7z

    Password: infected

  • 2704e269fb5cf9a02070a0ea07d82dc9d87f2cb95e60cb71d6c6d38b01869f66
    .exe windows:5 windows x86 arch:x86

    851a0ba8fbb71710075bdfe6dcef92eb


    Headers

    Imports

    Sections

  • 2cbb3497bfa28d9966c1feeae96d452d.7z
    .7z

    Password: infected

  • 2cbb3497bfa28d9966c1feeae96d452d
    .dll windows:6 windows x86 arch:x86

    36217a0c4f7978f0ff9a3dac914d5730


    Headers

    Imports

    Exports

    Sections

  • 37546b811e369547c8bd631fa4399730d3bdaff635e744d83632b74f44f56cf6.7z
    .7z

    Password: infected

  • 37546b811e369547c8bd631fa4399730d3bdaff635e744d83632b74f44f56cf6
    .exe windows:4 windows x86 arch:x86

    3548cf154854e23da2693c0c59187266


    Headers

    Imports

    Sections

  • 49d828087ca77abc8d3ac2e4719719ca48578b265bbb632a1a7a36560ec47f2d.7z
    .7z

    Password: infected

  • 49d828087ca77abc8d3ac2e4719719ca48578b265bbb632a1a7a36560ec47f2d
    .exe windows:5 windows x86 arch:x86

    380467bc2cc16b8ce64d4802632fe491


    Headers

    Imports

    Sections

  • 5F71BE645E8AC995555A891087B46ED357386DBE.7z
    .7z
  • 880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.7z
    .7z
  • 8dd8b9bd94de1e72f0c400c5f32dcefc114cc0a5bf14b74ba6edc19fd4aeb2a5.7z
    .7z
  • c316627897a78558356662a6c64621ae25c3c3893f4b363a4b3f27086246038d.7z
    .7z
  • c41a2ddf8c768d887b5eca283bbf8ea812a5f2a849f07c879808845af07409ed.7z
    .7z
  • d11793433065633b84567de403c1989640a07c9a399dd2753aaf118891ce791c.7z
    .7z
  • dcbbae5a1c61dbbbb7dcd6dc5dd1eb1169f5329958d38b58c3fd9384081c9b78.7z
    .7z