seon

General

Target

c5f08d2817646649d149abcaa60c8e3eb9d28100f4633c0c015ad14282e7184bN.exe
Size

79KB
Sample

250205-r6nk8a1kcz
MD5

2697ae10cca38a1a00a4a68c19cc8790
SHA1

3b9925f871fdaeab32ee58979d68c0ee63070070
SHA256

c5f08d2817646649d149abcaa60c8e3eb9d28100f4633c0c015ad14282e7184b
SHA512

d78692a5808262c2f1ffde68ce3c96ac6bdeb5b2db279d0173059951f951ceecf7188042ab3345e6c594f36123b8708ccce845b229f69beb9a27d9c848ad266a
SSDEEP

1536:/tUknV9M6+ygXCNoNGtmFWZPhV8owtnMQPo9NSw249gdhwA2jeddMJ:fCygXkoNGtmQZ5wbAzSm9gdhj2a6J

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Public\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note

You became victim of the GOLDENEYE RANSOMWARE! The files on your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page shown in step 2. To purchase your key and restore your data, please follow these three easy steps: 1. Download the Tor Browser at "https://www.torproject.org/". If you need help, please google for "access onion page". 2. Visit one of the following pages with the Tor Browser: http://golden5a4eqranh7.onion/tdXGi7Ge http://goldeny4vs3nyoht.onion/tdXGi7Ge 3. Enter your personal decryption code there: tdXGi7GexfZJeiHrJVyxVzAS5PgQqQyHYKxmq4SLAvKG6NZCBRAmzxR4eNAZxPRJJBfkHuktNQwaTmEm2jk2dNhtxVw3bCC8

URLs

http://golden5a4eqranh7.onion/tdXGi7Ge

http://goldeny4vs3nyoht.onion/tdXGi7Ge

Extracted

Path

C:\Users\Public\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note

You became victim of the GOLDENEYE RANSOMWARE! The files on your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page shown in step 2. To purchase your key and restore your data, please follow these three easy steps: 1. Download the Tor Browser at "https://www.torproject.org/". If you need help, please google for "access onion page". 2. Visit one of the following pages with the Tor Browser: http://golden5a4eqranh7.onion/nQDuNjnP http://goldeny4vs3nyoht.onion/nQDuNjnP 3. Enter your personal decryption code there: nQDuNjnPrAnJKJeYjATfJXqLDLMdjLUkFudVp2nncwVSDj5nubYr31RbaYe6MAfYfTZ7Ry9ihWiUGxqLqqQ54RRjiKixUXG5

URLs

http://golden5a4eqranh7.onion/nQDuNjnP

http://goldeny4vs3nyoht.onion/nQDuNjnP

Targets

- Target
  
  c5f08d2817646649d149abcaa60c8e3eb9d28100f4633c0c015ad14282e7184bN.exe
- Size
  
  79KB
- MD5
  
  2697ae10cca38a1a00a4a68c19cc8790
- SHA1
  
  3b9925f871fdaeab32ee58979d68c0ee63070070
- SHA256
  
  c5f08d2817646649d149abcaa60c8e3eb9d28100f4633c0c015ad14282e7184b
- SHA512
  
  d78692a5808262c2f1ffde68ce3c96ac6bdeb5b2db279d0173059951f951ceecf7188042ab3345e6c594f36123b8708ccce845b229f69beb9a27d9c848ad266a
- SSDEEP
  
  1536:/tUknV9M6+ygXCNoNGtmFWZPhV8owtnMQPo9NSw249gdhwA2jeddMJ:fCygXkoNGtmQZ5wbAzSm9gdhj2a6J
Score

10^/10

seon discovery ransomware spyware stealer trojan
- Seon
  The Seon Ransomware is an encryption ransomware Trojan first observed on November 14, 2018.
  trojan ransomware seon
- Seon family
  seon
- Renames multiple (194) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2