metasploit

General

Target

https://cdn.discordapp.com/attachments/1214735818472558646/1270183447918415902/robloxapp-20240802-1831583.wmv?ex=66b2c604&is=66b17484&hm=55b47e3987876be3720559b84781030d4a7f07fe97e2f75d58130ab55a74205c&
Sample

240806-ejtshayfrn

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Public\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note

You became victim of the GOLDENEYE RANSOMWARE! The files on your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page shown in step 2. To purchase your key and restore your data, please follow these three easy steps: 1. Download the Tor Browser at "https://www.torproject.org/". If you need help, please google for "access onion page". 2. Visit one of the following pages with the Tor Browser: http://golden5a4eqranh7.onion/o162RaRh http://goldeny4vs3nyoht.onion/o162RaRh 3. Enter your personal decryption code there: o162RaRhsAnwjVZ2ewgMZPSekvJhai1dhuCiYEJDYJxXu298RVUF4N3JwxLYx4B8E795aZXL8PHXMANGLzvAYkuPvkMN7UD3

URLs

http://golden5a4eqranh7.onion/o162RaRh

http://goldeny4vs3nyoht.onion/o162RaRh

Extracted

Family

metasploit

Version

windows/single_exec

Targets

- Target
  
  https://cdn.discordapp.com/attachments/1214735818472558646/1270183447918415902/robloxapp-20240802-1831583.wmv?ex=66b2c604&is=66b17484&hm=55b47e3987876be3720559b84781030d4a7f07fe97e2f75d58130ab55a74205c&
Score

10^/10

metasploit seon backdoor bootkit discovery persistence ransomware spyware stealer trojan
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Seon
  The Seon Ransomware is an encryption ransomware Trojan first observed on November 14, 2018.
  trojan ransomware seon
- Renames multiple (295) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Downloads MZ/PE file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1