metasploit

General

Target

http://pywolwnvd.biz/nfgam
Sample

250119-yph3qstnhp

Score

10^/10

Malware Config

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Path

C:\Users\Public\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note

You became victim of the GOLDENEYE RANSOMWARE! The files on your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page shown in step 2. To purchase your key and restore your data, please follow these three easy steps: 1. Download the Tor Browser at "https://www.torproject.org/". If you need help, please google for "access onion page". 2. Visit one of the following pages with the Tor Browser: http://golden5a4eqranh7.onion/rjBEQ5Wk http://goldeny4vs3nyoht.onion/rjBEQ5Wk 3. Enter your personal decryption code there: rjBEQ5WkHTKae3QUsynPhB84No4UTz1BoNxvU7FkWu1yLQ2x2JmUoX31LLiMh5bhbnZjABbBA7oF5UW1bRnj5AmMNrmLMjSc

URLs

http://golden5a4eqranh7.onion/rjBEQ5Wk

http://goldeny4vs3nyoht.onion/rjBEQ5Wk

Targets

- Target
  
  http://pywolwnvd.biz/nfgam
Score

10^/10

metasploit seon backdoor bootkit defense_evasion discovery execution persistence ransomware spyware stealer trojan
- MetaSploit
  Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
  trojan backdoor metasploit
- Metasploit family
  metasploit
- Seon
  The Seon Ransomware is an encryption ransomware Trojan first observed on November 14, 2018.
  trojan ransomware seon
- Seon family
  seon
- Renames multiple (134) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- System Binary Proxy Execution: Verclsid
  Adversaries may abuse Verclsid to proxy execution of malicious code.
  defense_evasion
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1