seon

General

Target

964b5abe3924a2efc07a955cce450291d880fe57be49018446143f9f3dcf0d7d
Size

79KB
Sample

250207-dhmgcsxqdj
MD5

322d73ea4ce5be6637f635125abee0d3
SHA1

7f6f6c2813768a8df111aad1ebec01b43a6517d3
SHA256

964b5abe3924a2efc07a955cce450291d880fe57be49018446143f9f3dcf0d7d
SHA512

27bebd8c71ac842146c8a599e23f76b7b648e59ee1df951e577a15ff8b40140a109566f66efa40e2465fd29a20a89f450404ec0b3a4c253dbf564fbbace1d1ad
SSDEEP

1536:/tUknV9M6+ygXCNoNGtmFWZPhV8owtnMQPo9NSw249gdhwA2jeddBu:fCygXkoNGtmQZ5wbAzSm9gdhj2aPu

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Public\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note

You became victim of the GOLDENEYE RANSOMWARE! The files on your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page shown in step 2. To purchase your key and restore your data, please follow these three easy steps: 1. Download the Tor Browser at "https://www.torproject.org/". If you need help, please google for "access onion page". 2. Visit one of the following pages with the Tor Browser: http://golden5a4eqranh7.onion/t9ehgJ9b http://goldeny4vs3nyoht.onion/t9ehgJ9b 3. Enter your personal decryption code there: t9ehgJ9bdVdM7zc2fFusYVqDFX4xidas4MFtQ6Z9j2uG5H9AvtrP86aMeYPfA41F3Tn75qizTUanfT6jfFVzvjYNrm36iBnN

URLs

http://golden5a4eqranh7.onion/t9ehgJ9b

http://goldeny4vs3nyoht.onion/t9ehgJ9b

Extracted

Path

C:\Users\Public\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note

You became victim of the GOLDENEYE RANSOMWARE! The files on your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page shown in step 2. To purchase your key and restore your data, please follow these three easy steps: 1. Download the Tor Browser at "https://www.torproject.org/". If you need help, please google for "access onion page". 2. Visit one of the following pages with the Tor Browser: http://golden5a4eqranh7.onion/s15r6kX6 http://goldeny4vs3nyoht.onion/s15r6kX6 3. Enter your personal decryption code there: s15r6kX6Rph4cEsVdUjHzAp9FqtVfeY1Xn8gj95ZjonsHZdTsEMxoWGAAgrpWqyXrA86NFiL4QgEvCK7WR6io459iYJHsuBU

URLs

http://golden5a4eqranh7.onion/s15r6kX6

http://goldeny4vs3nyoht.onion/s15r6kX6

Targets

- Target
  
  964b5abe3924a2efc07a955cce450291d880fe57be49018446143f9f3dcf0d7d
- Size
  
  79KB
- MD5
  
  322d73ea4ce5be6637f635125abee0d3
- SHA1
  
  7f6f6c2813768a8df111aad1ebec01b43a6517d3
- SHA256
  
  964b5abe3924a2efc07a955cce450291d880fe57be49018446143f9f3dcf0d7d
- SHA512
  
  27bebd8c71ac842146c8a599e23f76b7b648e59ee1df951e577a15ff8b40140a109566f66efa40e2465fd29a20a89f450404ec0b3a4c253dbf564fbbace1d1ad
- SSDEEP
  
  1536:/tUknV9M6+ygXCNoNGtmFWZPhV8owtnMQPo9NSw249gdhwA2jeddBu:fCygXkoNGtmQZ5wbAzSm9gdhj2aPu
Score

10^/10

seon discovery ransomware spyware stealer trojan
- Seon
  The Seon Ransomware is an encryption ransomware Trojan first observed on November 14, 2018.
  trojan ransomware seon
- Seon family
  seon
- Renames multiple (184) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2