General
-
Target
17611026749.zip
-
Size
3.1MB
-
Sample
240606-gbygtsaf26
-
MD5
65d3f925572be663d7e30060e5a689e8
-
SHA1
eec6c79715c7aec0fe66d33c7884ebce933d89ec
-
SHA256
2d77acd4c7b1cbea6844c312ada0d9b01f56a75fc240fd11a992df2011c8be92
-
SHA512
9e96a0bc52a53c43a0ae6cc35109d63aa0a3b996147c3bcf2f170eb9b316ecb486b1dd56fe13d7dc62741cbf12785a844bee87f6015f7a01a049faad4a52ef6e
-
SSDEEP
98304:NNp1gi/B9dz0yTXU6DsuK+M3KMIO6VWi1L0ky:NNpqi/B3Jx12KPOkG
Static task
static1
Behavioral task
behavioral1
Sample
aa0772fc6784799d59649654879c2b4a23919cda410bede0162751e6d6d6b558.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
aa0772fc6784799d59649654879c2b4a23919cda410bede0162751e6d6d6b558.dll
Resource
win10v2004-20240426-en
Malware Config
Extracted
agenda
-
company_id
rVA0Ynm3YN
-
note
-- Qilin Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from you system/network If you refuse to communicate with us and we do not come to an agreement, your data will be published. Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials -- Backup communication via mail. in case you can't access your personal account - [email protected] Credentials Extension: rVA0Ynm3YN Domain: srb6w7f4y3ldfeb6esog4ttfh4mqttwyppihwuvjsnviq6z3e52qsyqd.onion login: XQblMmOaQgsylN2zRnn2wNVae7OOuncb password:
Targets
-
-
Target
aa0772fc6784799d59649654879c2b4a23919cda410bede0162751e6d6d6b558
-
Size
5.0MB
-
MD5
440810b008eed766f085b69b1723f54b
-
SHA1
9692644974071cd484455e355f8d79ce8c486e20
-
SHA256
aa0772fc6784799d59649654879c2b4a23919cda410bede0162751e6d6d6b558
-
SHA512
99f37c6f1e31c79836427297a15292e79f3a6dcf90e128ab721bbc57ed8e0ca4ab14d662c74bbf7c9c1c6ae66fb5b772a706d0940b487289f7397d1c15ce67a9
-
SSDEEP
98304:bMHGypxjgEqr4y5f18zKUC11G5+ovCoTUYPK7RP684:b0/Dj8fBUC1g5+ovC4BPKc84
Score10/10-
Agenda Ransomware
A ransomware with multiple variants written in Golang and Rust first seen in August 2022.
-