seon

General

Target

8421ee120052d1929b0f23bc01d4f14a6f215c53859666596478f64a240dd8abN.exe
Size

79KB
Sample

250205-nmlezawlbn
MD5

a8f66777bacc19d0ec304b2a5a5e69f0
SHA1

f0805638985fde45bb8024ea1cbd727747d666ea
SHA256

8421ee120052d1929b0f23bc01d4f14a6f215c53859666596478f64a240dd8ab
SHA512

90691c21d028f50f854b3ba10ba24523b43f256c45522ba22ff7eabeab430e1b554a800c844fe0357158f21694548184217d0486dcd7f2d370afa4b133006c25
SSDEEP

1536:/tUknV9M6+ygXCNoNGtmFWZPhV8owtnMQPo9NSw249gdhwA2jeddCj:fCygXkoNGtmQZ5wbAzSm9gdhj2aMj

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Public\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note

You became victim of the GOLDENEYE RANSOMWARE! The files on your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page shown in step 2. To purchase your key and restore your data, please follow these three easy steps: 1. Download the Tor Browser at "https://www.torproject.org/". If you need help, please google for "access onion page". 2. Visit one of the following pages with the Tor Browser: http://golden5a4eqranh7.onion/nZs9ZuNv http://goldeny4vs3nyoht.onion/nZs9ZuNv 3. Enter your personal decryption code there: nZs9ZuNvnFMPNDkhbGbdUgzUP3KgxXiG1vRoVtve6a1wikKsmkpd6agBjWv5i6c768k2wm3538sNzEAHQwsMAyBbTezgZLC4

URLs

http://golden5a4eqranh7.onion/nZs9ZuNv

http://goldeny4vs3nyoht.onion/nZs9ZuNv

Extracted

Path

C:\Users\Public\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note

You became victim of the GOLDENEYE RANSOMWARE! The files on your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page shown in step 2. To purchase your key and restore your data, please follow these three easy steps: 1. Download the Tor Browser at "https://www.torproject.org/". If you need help, please google for "access onion page". 2. Visit one of the following pages with the Tor Browser: http://golden5a4eqranh7.onion/pGRuG5hc http://goldeny4vs3nyoht.onion/pGRuG5hc 3. Enter your personal decryption code there: pGRuG5hcceawMrXt7T2xRvatJmdeLX3gbGmA3mS855MtycP3dVvLndpaEXf4e9j6zqx2Hix3rEg74mf7FLndKQfvkaKkMP56

URLs

http://golden5a4eqranh7.onion/pGRuG5hc

http://goldeny4vs3nyoht.onion/pGRuG5hc

Targets

- Target
  
  8421ee120052d1929b0f23bc01d4f14a6f215c53859666596478f64a240dd8abN.exe
- Size
  
  79KB
- MD5
  
  a8f66777bacc19d0ec304b2a5a5e69f0
- SHA1
  
  f0805638985fde45bb8024ea1cbd727747d666ea
- SHA256
  
  8421ee120052d1929b0f23bc01d4f14a6f215c53859666596478f64a240dd8ab
- SHA512
  
  90691c21d028f50f854b3ba10ba24523b43f256c45522ba22ff7eabeab430e1b554a800c844fe0357158f21694548184217d0486dcd7f2d370afa4b133006c25
- SSDEEP
  
  1536:/tUknV9M6+ygXCNoNGtmFWZPhV8owtnMQPo9NSw249gdhwA2jeddCj:fCygXkoNGtmQZ5wbAzSm9gdhj2aMj
Score

10^/10

seon discovery ransomware spyware stealer trojan
- Seon
  The Seon Ransomware is an encryption ransomware Trojan first observed on November 14, 2018.
  trojan ransomware seon
- Seon family
  seon
- Renames multiple (240) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2