Overview

overview

10

Static

static

3

2dbea739ec...18.exe

windows7-x64

10

2dbea739ec...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2dbea739ec5c54b1a3bcebcd138d50be_JaffaCakes118

  • Size

    78KB

  • Sample

    240708-zk3f9azgrb

  • MD5

    2dbea739ec5c54b1a3bcebcd138d50be

  • SHA1

    8983c117646ced45f438e7b5e862e3a4c725edca

  • SHA256

    5b60c68944368c9b21e4333f3f289152f15e69ce2a4ff387fb7a0005cb990bfb

  • SHA512

    0027b04b3f7fa337e7956ac226fd34c7344d0c7a2a32ae58fe730870b7e812a098a3fe713d5fdcf0d797254d4497d3e2511ed09227d308fa671231c0f0f047e4

  • SSDEEP

    1536:JtUknV9M6+ygXCNoNGtmFWZPhV8owtnMQPo9NSw249gdhwA2jeddm0cW:VCygXkoNGtmQZ5wbAzSm9gdhj2aI0cW

Score
10/10
seonransomwarespywarestealertrojan

Malware Config

Extracted

Path

C:\Users\Public\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note
You became victim of the GOLDENEYE RANSOMWARE! The files on your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page shown in step 2. To purchase your key and restore your data, please follow these three easy steps: 1. Download the Tor Browser at "https://www.torproject.org/". If you need help, please google for "access onion page". 2. Visit one of the following pages with the Tor Browser: http://golden5a4eqranh7.onion/xAKLXWQm http://goldeny4vs3nyoht.onion/xAKLXWQm 3. Enter your personal decryption code there: xAKLXWQmvBPZzm9mSH3XhGpGLvM4Hue9Vb5gB1bfVh2ievk2hZxvM1pJdNWQiaxwWnwuWea4qge2TjkhHASQXAW3MA7vEoyS
URLs

http://golden5a4eqranh7.onion/xAKLXWQm

http://goldeny4vs3nyoht.onion/xAKLXWQm

Extracted

Path

C:\Users\Public\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note
You became victim of the GOLDENEYE RANSOMWARE! The files on your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page shown in step 2. To purchase your key and restore your data, please follow these three easy steps: 1. Download the Tor Browser at "https://www.torproject.org/". If you need help, please google for "access onion page". 2. Visit one of the following pages with the Tor Browser: http://golden5a4eqranh7.onion/pf3zApGB http://goldeny4vs3nyoht.onion/pf3zApGB 3. Enter your personal decryption code there: pf3zApGBMkE5mYoHAKp5wkXVMuNZbzpU28ZSwxPSNsUrmi1ktmcau9VmhPb7F5KeAHSw3a4bcUosmv2yQSMbDxsyeCTph2c1
URLs

http://golden5a4eqranh7.onion/pf3zApGB

http://goldeny4vs3nyoht.onion/pf3zApGB

Targets

    • Target

      2dbea739ec5c54b1a3bcebcd138d50be_JaffaCakes118

    • Size

      78KB

    • MD5

      2dbea739ec5c54b1a3bcebcd138d50be

    • SHA1

      8983c117646ced45f438e7b5e862e3a4c725edca

    • SHA256

      5b60c68944368c9b21e4333f3f289152f15e69ce2a4ff387fb7a0005cb990bfb

    • SHA512

      0027b04b3f7fa337e7956ac226fd34c7344d0c7a2a32ae58fe730870b7e812a098a3fe713d5fdcf0d797254d4497d3e2511ed09227d308fa671231c0f0f047e4

    • SSDEEP

      1536:JtUknV9M6+ygXCNoNGtmFWZPhV8owtnMQPo9NSw249gdhwA2jeddm0cW:VCygXkoNGtmQZ5wbAzSm9gdhj2aI0cW

    Score
    10/10
    seonransomwarespywarestealertrojan

    • Seon

      The Seon Ransomware is an encryption ransomware Trojan first observed on November 14, 2018.

      trojanransomwareseon

    • Renames multiple (244) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks