metasploit

General

Target

https://download.overwolf.com/install/Download?PartnerId=3762&utm_source=google&utm_medium=cpc&utm_campaign=21268940350&gclid=CjwKCAjwjsi4BhB5EiwAFAL0YL6pQ47jirruo-pmFEOkklOaNWWPQJGq6IhGBZ4Uv7pbnpQ20WgZQBoCZRMQAvD_BwE&utm_content=Buff_AW_CjwKCAjwjsi4BhB5EiwAFAL0YL6pQ47jirruo-pmFEOkklOaNWWPQJGq6IhGBZ4Uv7pbnpQ20WgZQBoCZRMQAvD_BwE&utm_term=
Sample

241019-aqhatsxhmq

Score

10^/10

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

0.tcp.ngrok.io:19521

Mutex

RV_MUTEX

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Path

C:\Users\Public\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note

You became victim of the GOLDENEYE RANSOMWARE! The files on your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page shown in step 2. To purchase your key and restore your data, please follow these three easy steps: 1. Download the Tor Browser at "https://www.torproject.org/". If you need help, please google for "access onion page". 2. Visit one of the following pages with the Tor Browser: http://golden5a4eqranh7.onion/xVYwHU1r http://goldeny4vs3nyoht.onion/xVYwHU1r 3. Enter your personal decryption code there: xVYwHU1rpkV4FW7fynM8V9KJbLUWf41EPa3WhHd4JQaPJqLMm2We6Dek5v6A3BYpY8eNVQfuqdASwPWR25u6vKePPsWA49gq

URLs

http://golden5a4eqranh7.onion/xVYwHU1r

http://goldeny4vs3nyoht.onion/xVYwHU1r

Targets

- Target
  
  https://download.overwolf.com/install/Download?PartnerId=3762&utm_source=google&utm_medium=cpc&utm_campaign=21268940350&gclid=CjwKCAjwjsi4BhB5EiwAFAL0YL6pQ47jirruo-pmFEOkklOaNWWPQJGq6IhGBZ4Uv7pbnpQ20WgZQBoCZRMQAvD_BwE&utm_content=Buff_AW_CjwKCAjwjsi4BhB5EiwAFAL0YL6pQ47jirruo-pmFEOkklOaNWWPQJGq6IhGBZ4Uv7pbnpQ20WgZQBoCZRMQAvD_BwE&utm_term=
Score

10^/10

metasploit njrat revengerat seon guest backdoor bootkit discovery evasion persistence privilege_escalation ransomware spyware stealer trojan
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- RevengeRAT
  Remote-access trojan with a wide range of capabilities.
  trojan revengerat
- Seon
  The Seon Ransomware is an encryption ransomware Trojan first observed on November 14, 2018.
  trojan ransomware seon
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Renames multiple (287) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- RevengeRat Executable
  stealer
- Disables Task Manager via registry modification
  evasion
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of SetThreadContext
behavioral1