kuiper | a4012358b18920f29509210e1262f744bdbc8c4534b77d09c6898564d3269d00

General

Target
2025-11-12_af906777fcd0a77642eccb906abe2b66_cobalt-strike_coinminer_elex_frostygoop_gcleaner_glassworm_sliver_snatch
Size 2.4MB
Sample251112-cb2f9sfk2t
SHA256 a4012358b18920f29509210e1262f744bdbc8c4534b77d09c6898564d3269d00
MD5 af906777fcd0a77642eccb906abe2b66
SHA1 a761f9282f63c6a4dc2e4b6480e43512e35c4602
SHA512 62fbabaa99e6250e0f8e201375fa7db97ba0cad046f53b163af86d7eace0a242dd7924cfe004004494b7841db370d6a4ef1870892fa24dd943b40d2d3f366836
SSDEEP 49152:Qb8vgtKC/1bQsG49vZGqsCz9/w7E8gR1z1:QYvg/Qs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\Common Files\System\Ole DB\de-DE\README_TO_DECRYPT.txt

Ransom Note

Your network has been compromised! All your important data has been encrypted! There is only one way to get your data back to normal: 1. Contact us as soon as possible to avoid damages and losses from your business. 2. Send to us any encrypted file of your choice and your personal key. 3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files. 4. Pay the amount required in order to restore your network back to normal. 5. We will then send you our software to decrypt and will guide you through the whole restoration of your network. We prefer Monero (XMR) - FIXED PRICE We accept Bitcoin (BTC) - 20% extra of total payment! ============================================================================================================================ WARNING! Do not rename encrypted data. Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover. ============================================================================================================================ Contact information: In order to contact us, download with the following software: https://qtox.github.io or https://tox.chat/download.html Then just add us in TOX: D27A7B3711CD1442A8FAC19BB5780FF291101F6286A62AD21E5F7F08BD5F5F1B9803AAC6ECF9 If there is any problems setting up TOX then just write to us at the following mail, it will only apply for problems setting up TOX and contacting us through TOX: [email protected] ============================================================================================================================ Your personal id: 5253413d62646666316237316165626463623239303561656339646362373735336561613a373236616166646138623065613663326532313539356332396363663266643231393664393963656233656566643538323665656637333734393236343338666661636130353362663538353631376438353739333233386536356538663165646135333734623761316635323662366238306330323831353631336332343531643037643961643339363366616166383665336361326134636166373266306230626563336362386166303661643964653162373163626564633237636332313430323735373131383462626139306433333064663632626561316366356338326463656135346465646230323834663264663237363566343734303363656131346131643335353762323230613738346561633465313533333534656639316135383363623234343739353933626531353730656562363033323163666631386261633466333766313030313731383337306364386531383761356533333135333136376432336639303337326337663638396232623534633737373166396531626434353737353137316366383863363031363832386364303339373930623464376232346133356463393361323765343262383730636662333634393031326234376132613437383564643865646166623536616230383433643139383564393666663761636539316535336431343935326335303939386236643733323338666563396637616665366162313333353363343464306235653537313164636532363661393932393432373030333539616334316161373862396537376431663661393464396638656635313035646361633137303466323533666666303137383362373737333933613239653637663663613764656237343632376162393461613432313533373065366361376633373732396238343733643632343565363261323234383635653031336461323833333663633830323737383131653335376530656433383163613933333231363835363133323565643134373537653131663564376138316439623162313266613233313033396131636430333131386633306436616336336431636333373637346137393465363163623739623236393764396534633265313837333534346235366535633062646165373966613563343832386464366332363033323062663264373462373562613065626461336266616631613666363434613035343138383261386630343361313062646364653035336133343338303433353463313561663663363836336433613465613662353836633932633465306464616437613663313861663134376361383234303035383465336435663736666135636235303534633033666562633835656463623435383433323935616465373639353065376138626564396130363a33643130316563306265653533373738316535626532613462363230316236386634346334393366633262396162626235626161393936623464356232343434623330646435373638366163343933336332326661653363326462346165653565363237303730373735663030376331646638663032353338346530636237353565613261383235323430376439386234646564323835393835626137363864356666346636616563663961623330613831363933613363393235303063383132356264313034353237366135316162346431303230396337626564663663366530326136356363356134356433396337363766616135376538303763393837303438386230383465666265653063316661633639333561643234326338356331336136326430356538333862366134336331343463396562633934336633666235626133393135306331323634643233393162613861386432326263336163343762316361646566646165333765323630336338303433346164316662326334636132333464653138656463336135343130363762353266376163616330326238656435376263643430303264386537653265346338613631626538633039373539366165383931656134393331626439303062313062366430633766613364656233323462626334633437636563326663346136303931666665653433666135326366343461663130303333343866613861353133333364376561316666353534396430653036373164373932333536383733663431323861663861646539646230643438643838383763636266656365316466346638636335626339643139616632646333353438653663366334353739326433313038613864666530666636613963373866303762303966393066626265663765626361393661363961636166346636643939323133343766313735343036323533303733383335396631343131323733363761626263656137373134623363336231376535363236666236303932383239383665383631393035323461666538346463393434333966303363656164616361373463303863643862383861653334336234366131393837663035636533653732316261303162366536653462313666303736336135343636343634616364643536353234336537336463383731333966636463356363333163306538376531376536393466636561323932633239353262366532336437343137353965613735633464363864363964316463323233626564633163623862393563626534353261373037656137336237376162643764336239353533366562356133316233306662626261383135383862373765653331336535306262343161346562336532653939353731633665623535653762626638623136

Emails

[email protected]

URLs

https://qtox.github.io
https://tox.chat/download.html

Extracted

Path

C:\Program Files\Common Files\System\Ole DB\en-US\README_TO_DECRYPT.txt

Ransom Note

Your network has been compromised! All your important data has been encrypted! There is only one way to get your data back to normal: 1. Contact us as soon as possible to avoid damages and losses from your business. 2. Send to us any encrypted file of your choice and your personal key. 3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files. 4. Pay the amount required in order to restore your network back to normal. 5. We will then send you our software to decrypt and will guide you through the whole restoration of your network. We prefer Monero (XMR) - FIXED PRICE We accept Bitcoin (BTC) - 20% extra of total payment! ============================================================================================================================ WARNING! Do not rename encrypted data. Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover. ============================================================================================================================ Contact information: In order to contact us, download with the following software: https://qtox.github.io or https://tox.chat/download.html Then just add us in TOX: D27A7B3711CD1442A8FAC19BB5780FF291101F6286A62AD21E5F7F08BD5F5F1B9803AAC6ECF9 If there is any problems setting up TOX then just write to us at the following mail, it will only apply for problems setting up TOX and contacting us through TOX: [email protected] ============================================================================================================================ Your personal id: 5253413d62646666316237316165626463623239303561656339646362373735336561613a336262373335363035636566663839366465646463636563323630363036653831636265323332393333343131396438393764616665643165306666626361336438373564623337303664336631376531363334393861663136386135386661316364633831363138386465323837633938306330323539646431383935626432633961323438376331643566636436613533666135376432626163366631653963396462643061343333323733333433653438346666393135326636626635656332366564306334613630663564636561613861626264383965383664386138393039383433633433323633316434626566346365633066303533306139363365346261623239383661353866396262663464343734623463376564666239616263303332633662663934666562643364396331396266346365646232393665653730326663633537663864663138613665653538353232643431363863346231656362366433323439323063333366663334373063663064376334323539333764363665326137613364333135363030383463306265366264343037383363646137353131333933373732643765343035303438386562356432376334303930613330323739396436353138343961363464373762306666323665316439363534303035306265303139626366633438383231376166343230626537343935646563376339386361346433306534326239303830393438343961383833326466643362653432656662383663633037663363623733363465366238313130643031306163646266386666333061623333313835306231313436303037376239396434313338333936636265653861356162383037653236393031346134313865646563626133643130616330333430653862313865346361366365376664313538613765333234623639623831646330666466613833333432376432333536383432663430316433363335343538623738323934646164666436373635613165393737313335316164336566383661323961623830363139363433306238656566323666393336316239313062666362663232616435383265343839646535396161313830636666376230313062336664306165343231353966646366626463336232333133643332393535383931373965363532616632626565353633316461336336333366373066346639313436626431336238666230313939386265373462653232376362626133616233373133613838363662636465393161363436363164376162336436333235333238353662616364356634356561623864383037343664643733623638323731303865383663646466303031383633373531346264323961366266306261666263383964313161666138323363383664313a31316265356362333131326436306332306239373138323332323363646464396131613237336134663436363231353061333239363362653834373633353335363531336435356363363734623930313537623333373830303834323237373963316332316436636534653335663437653131373932393634333730666537366265663036336639326361633133393761383632356234646632323336663263663534383732656634616165663065393231373137633139636634333231313435663266633361306439653763653838336566653435646333376533323433383461346462653639333438343763646465666566653261353433323236376536663464383337313034353532646530623764666465313832396530363964373362663235313534323839303233613564643631653136643236333631363634313538353530346331373764333530343430386262393431363566323636653737353765656636383062343135363765376265623966633739323861666633383430303163303763336532626337393632353733396639333731333238333364323738353135363663383132653265393634353235666332356536356132313734616438303335343462656132316638306561313563666530363536313663393837333232656130333164386339383562643930383634663065346437653032613634633061623836643764623530623366343739313137323364346239636533353937313461303665396661313761356136613032326136656465656364666464373062636133363235386130363365386362656239613266393562303738393664343934303337336339356362333134363137643030396433373663363462366332643565633863306536346338363434646432396430656664346339323164663837386237633136623031343832353962306365373336663162616365346236396632623438613766653034373139353464646464616162653238633466643763383230316162393032303933386538613763313531353763663636653662656434313865633530326633363732363864303930393636666135666663363665643161613863653664633030663336376264616633323762353963343665633065633735623435333938633563333139323662363661613764623632386433303939326232313565383264356537336362393635316434363530373731363062313564383738356264313630386263343234646163393531306466306233323566636366323362303561663734376465613263326563313364653866623637333866376162306630333438623830343235386166633132646535393462613734643836383063303131323466663739323563636536303235356436353364

Emails

[email protected]

URLs

https://qtox.github.io
https://tox.chat/download.html

Targets

- Target
  2025-11-12_af906777fcd0a77642eccb906abe2b66_cobalt-strike_coinminer_elex_frostygoop_gcleaner_glassworm_sliver_snatch
- Size 2.4MB
- SHA256 a4012358b18920f29509210e1262f744bdbc8c4534b77d09c6898564d3269d00
- MD5 af906777fcd0a77642eccb906abe2b66
- SHA1 a761f9282f63c6a4dc2e4b6480e43512e35c4602
- SHA512 62fbabaa99e6250e0f8e201375fa7db97ba0cad046f53b163af86d7eace0a242dd7924cfe004004494b7841db370d6a4ef1870892fa24dd943b40d2d3f366836
- SSDEEP 49152:Qb8vgtKC/1bQsG49vZGqsCz9/w7E8gR1z1:QYvg/Qs
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

defense_evasion discovery execution ransomware
- Clears Windows event logs
  defense_evasion ransomware
- Renames multiple (3052) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Drops desktop.ini file(s)
behavioral1 behavioral2