General
-
Target
17634066488.zip
-
Size
3.1MB
-
Sample
240606-fgxxtahh37
-
MD5
7457c1c16c050cfc9e89725ebb4a16bf
-
SHA1
7d9571b6328f7bf837ccbc64a4440ac2d5abdf3a
-
SHA256
4e0ae82a30abb62e822f3070ba61c39b3af292e3914c83b236b446470b94ad9c
-
SHA512
bfe6e8298e7d5efa2ea41965985d9812fb88a9d71f39ac831a8db655bd39faf61dae7e2375f8b8bd09f0198ad1e9ce819be2d6bede84ebeed37fdf83a93b9165
-
SSDEEP
49152:TTuG1cS2k2L/zO/dHAEdLbRZ7srfktivyH6xLDoDtUvNHCHM4t2cLaJXyp73g8su:v1cZOVHAYNZgIwDoxOTCLayp73zsu
Static task
static1
Behavioral task
behavioral1
Sample
8e1eb0ad22236e325387fdb45aea63f318a672c5d035a21d7b3a64eeafb4c5a2.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
8e1eb0ad22236e325387fdb45aea63f318a672c5d035a21d7b3a64eeafb4c5a2.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
agenda
- Username:
[email protected] - Password:
ItGroup2014
-
company_id
24BSDin-W_
-
note
-- Qilin Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from you system/network If you refuse to communicate with us and we do not come to an agreement, your data will be published. Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials-- Credentials Extension: 24BSDin-W_ Domain: 4pen4sc3leywcd4qof2ytyngjqoltib6vutcrjvaxevtmofdjsrsw4qd.onion login: f2nONLjvh-liHP-kArAZKegtTfTVF6W_ password:
Targets
-
-
Target
8e1eb0ad22236e325387fdb45aea63f318a672c5d035a21d7b3a64eeafb4c5a2
-
Size
5.0MB
-
MD5
d67303ba66bcb4dd89de87c83f3f831f
-
SHA1
34bfe0c8aa61f90ca03b7e80271d5a8afae0be4b
-
SHA256
8e1eb0ad22236e325387fdb45aea63f318a672c5d035a21d7b3a64eeafb4c5a2
-
SHA512
93380d0007c08c96f8431a2958af4c64416de1250d8f836b1f6fda62a3dba908229c272e1db31a7e1d56797a5bde44c538edf417d353d08dc89caf77c17a29df
-
SSDEEP
98304:pJ5JuBHJK8oXqPVEjp5AT/GNZcGeKz3ZRBTum3p2n31RJ:pJqg8oaEy/mOGN3shRJ
Score10/10-
Agenda Ransomware
A ransomware with multiple variants written in Golang and Rust first seen in August 2022.
-