Overview

overview

10

Static

static

1

1da86aa042...8b.elf

ubuntu-24.04-amd64

10

Resubmissions

30/06/2025, 15:18

250630-spms2abm8v10

15/03/2025, 02:13

250315-cnlatatsfz3

Sharing

Copy URL Twitter E-mail

General

  • Target
    1da86aa04214111ec8b4a2f46e6450f41233da1110f0b32890d522285a2ae38b.elf
  • Size 3.5MB
  • Sample250630-spms2abm8v
  • SHA256 1da86aa04214111ec8b4a2f46e6450f41233da1110f0b32890d522285a2ae38b
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
defense_evasiondiscoverylinuxpersistenceprivilege_escalationransomware

Malware Config

Extracted

Path

  • /home/HOW_RETURN_YOUR_DATA.TXT

Ransom Note
  • Hello! Your files have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics. All you need to do is contact us and pay. --- Our communication process: 1. You contact us. 1. We send you a list of files that were stolen. 2. We decrypt 1 file to confirm that our decryptor works. 3. We agree on the amount, which must be paid using BTC. 4. We delete your files, we give you a decryptor. 5. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future. --- Client area (use this site to contact us): Link for Tor Browser: http://26ubgm3vvrjawkdyfhvl2d2nhq77nu3zsagbih4yy2zgau5uv5ivfgyd.onion/dd6a54ac101e46032344dd2cef5e328a >>> to begin the recovery process. * In order to access the site, you will need Tor Browser, you can download it from this link: https://www.torproject.org/ --- Recommendations: DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. --- Important: If you refuse to pay or do not get in touch with us, we start publishing your files. Ehe decryptor will be destroyed and the files will be published on our blog. Blog: http://dataleakypypu7uwblm5kttv726l3iripago6p336xjnbstkjwrlnlid.onion Sincerely!
URLs

  • http://26ubgm3vvrjawkdyfhvl2d2nhq77nu3zsagbih4yy2zgau5uv5ivfgyd.onion/dd6a54ac101e46032344dd2cef5e328a

  • http://dataleakypypu7uwblm5kttv726l3iripago6p336xjnbstkjwrlnlid.onion

Targets

    • Target
      1da86aa04214111ec8b4a2f46e6450f41233da1110f0b32890d522285a2ae38b.elf
    • Size 3.5MB
    • SHA256 1da86aa04214111ec8b4a2f46e6450f41233da1110f0b32890d522285a2ae38b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    defense_evasiondiscoverypersistenceprivilege_escalationransomware
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks