metasploit

General

Target

http://google.com
Sample

250119-w1m5qazqfq

Score

10^/10

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Path

C:\Users\Public\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note

You became victim of the GOLDENEYE RANSOMWARE! The files on your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page shown in step 2. To purchase your key and restore your data, please follow these three easy steps: 1. Download the Tor Browser at "https://www.torproject.org/". If you need help, please google for "access onion page". 2. Visit one of the following pages with the Tor Browser: http://golden5a4eqranh7.onion/yBQkQqfh http://goldeny4vs3nyoht.onion/yBQkQqfh 3. Enter your personal decryption code there: yBQkQqfhzmAgnaSaYpnCbdPiUa3SuHCxjwVWkbocAEJ9c4Cc7hXiRPHrVS9EuHjQCg8S8rkVgbhtWSVoYEy5gjaupfGFkNPG

URLs

http://golden5a4eqranh7.onion/yBQkQqfh

http://goldeny4vs3nyoht.onion/yBQkQqfh

Targets

- Target
  
  http://google.com
Score

10^/10

metasploit revengerat seon backdoor bootkit credential_access defense_evasion discovery persistence privilege_escalation ransomware spyware stealer trojan
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Metasploit family
  metasploit
- RevengeRAT
  Remote-access trojan with a wide range of capabilities.
  trojan revengerat
- Revengerat family
  revengerat
- Seon
  The Seon Ransomware is an encryption ransomware Trojan first observed on November 14, 2018.
  trojan ransomware seon
- Seon family
  seon
- Renames multiple (352) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- RevengeRat Executable
  stealer
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- System Binary Proxy Execution: Verclsid
  Adversaries may abuse Verclsid to proxy execution of malicious code.
  defense_evasion
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1