Overview

overview

10

Static

static

10

2025-12-10...ch.exe

windows10-2004-x64

10

2025-12-10...ch.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2025-12-10_c3e134d9c151661fb457e1e30d5ea43a_coinminer_sliver_snatch
  • Size 2.9MB
  • Sample251210-bswrnssley
  • SHA256 a6b43e0d4337d7ba8ab0126bf9bcf841238dafb8f2145353400ae788317aeb18
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
vashsorenacredential_accessdefense_evasiondiscoveryexecutionransomwarespywarestealer

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://e-service.iag.bg/App_Themes/Efa/clear.txt

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://e-service.iag.bg/App_Themes/Efa/video.mp4

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://e-service.iag.bg/App_Themes/Efa/End.exe

Extracted

Path

  • C:\Users\Public\Desktop\HELP_DECRYPT_YOUR_FILES.html

Ransom Note
  • <!DOCTYPE html><html><body><div class=demo> <h1>All of your important files encrypted with AES-256, RSA-2848 , is a powerful cryptography algorithm</h1> <p>For more information you can use Wikipedia</p> <p>*attention: Don't rename or edit encrypted files because it will be impossible to decrypt your files</p> <p>This is a private ransomware developed by our team and there is no decryption file for it</p> <br /> <p style=color:#703818;>For Trust You can Send us Test Files And We Decrypt That And Send To You.</p> <br /> <h2>*How do I contact you?</h2> <h2>The only way to communicate is through a secure Telegram messenger</h2> <h2>Telegram ID : https://t.me/HELP_DECRYPT_YOUR_FILES</p> <h2>Your unique Id : XBADFMJU </h2> <br /><h2>How To Access Telegram</h2> <h2>To access Telegram, you must install the version related to your platform</h2> <h2>You can download Telegram from https://telegram.org</h2> <br /><p>#How to recover files?</p> <br /> <p>How files are decrypted? What is the decryption file like? Watch file Watch-me.mp4 on each drive and desktop</p> <div class=VideoDiv> <video width=400 height=400 controls><source src=C:/Users/Public/Music/video.mp4 type=video/mp4></video></div><br /><p>You need two key</p> <p>1-Public key: you need it for encryption<p>2-Private Key: you need it for decryption</p> <p>All of your network computers files is encrypted with one public key. So you need just one Private key to recover all computers files</p> <p>The private Key that we will send works on all your computers</p> <br /> <p>#How to use private Key?</p> <p>We send you a simple software with private Key</p> <p>And you just need run this software on each computer that encrypted and all affected files will be decrypted</p> <br /> <p>*What are the guarantees that I can decrypt my files after paying the ransom?</p><p>Your main guarantee is the ability to decrypt test files.</p> <p>This means that we can decrypt all your files after paying the ransom.</p> <p>We have no reason to deceive you after receiving the ransom, because it harms our business</p> <p>You Have 24 hours to Decide to Pay</p> <p>after 48 hours Decryption Price will Be Double</p> <p>And after 72 hours it will be triple Try to Contact late and You will know</p> <p>Therefore, we recommend that you make payment within a few hours.</p><br /><p style=color:#d61d1d; >#deadline</p><p>You just have 72 hours to send us the Bitcoin after 72 hours we will remove your private key and it's impossible to recover your files</p><br /><p>#What is Bitcoin?</p><p>Bitcoin is an innovative payment network and a new kind of money.</p><p>You can create a Bitcoin account at https://blockchain.info/ and deposit some money into your account and then send to us</p><br /><p>#How to buy Bitcoin?</p><p>There are Many way to buy Bitcoin and deposit it into your account,</p><p>You can buy it with WesternUnion, Bank Wire, International Bank transfer, Cash deposit and etc</p><p>https://localbitcoins.com ---> Buy Bitcoin with WesternUnion or MoneyGram</p><p>https://coincafe.com ---> Buy Bitcoin fast and Secure with WesternUnion and Cash deposit</p><p>https://www.bitstamp.net ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>httos://www.kraken.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>https://www.kraken.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>https://www.ccedk.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>https://bitcurex.com/ ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>If you want to pay with your Business bank account you should create a business account in exchangers they don't accept payment from third party</p></div><style>Demo Styles*/html {height: 100%;box-sizing: border-box;}*,*:before,*:after {box-sizing: inherit;}body {position: relative;margin: 0;padding-bottom: 6rem;min-height: 100%;font-family: Helvetica Neue, Arial, sans-serif;font-weight: bold;background: #000;}.demo {margin: 0 auto;}.demo h1 { margin-top: 15;text-align: center;font-size: 25px;color: #d34410;}.demo h2 { margin-top: 15;text-align: center;font-size: 25px;color: #16419e;}.demo p {margin-top: 10;text-align: center;font-size: 20px;color: #cccccc;}.demo .VideoDiv{margin:0 auto;background:red;border:2px solid #ffffff; width:400px;;height:400px}</style></body></html>
URLs

  • https://t.me/HELP_DECRYPT_YOUR_FILES</p>

Extracted

Path

  • C:\Users\Public\Desktop\HELP_DECRYPT_YOUR_FILES.txt

Ransom Note
  • All of your important files encrypted with AES-256, RSA-2848 , is a powerful cryptography algorithm For more information you can use Wikipedia *attention: Don't rename or edit encrypted files because it will be impossible to decrypt your files This is a private ransomware developed by our team and there is no decryption file for it For Trust You can Send us Test Files And We Decrypt That And Send To You. *How do I contact you? The only way to communicate is through a secure Telegram messenger Telegram ID : https://t.me/HELP_DECRYPT_YOUR_FILES Your unique Id : XBADFMJU How To Access Telegram To access Telegram, you must install the version related to your platform You can download Telegram from https://telegram.org #How to recover files? How files are decrypted? What is the decryption file like? Watch file Watch-me.mp4 on each drive and desktop You need two key 1-Public key: you need it for encryption 2-Private Key: you need it for decryption So you need Private key to recover your files. All of your network computers files is encrypted with one public key. So you need just one Private key to recover all computers files The private Key that we will send works on all your computers #How to use private Key? We send you a simple software with private Key And you just need run this software on each computer that encrypted and all affected files will be decrypted *What are the guarantees that I can decrypt my files after paying the ransom? Your main guarantee is the ability to decrypt test files. This means that we can decrypt all your files after paying the ransom. We have no reason to deceive you after receiving the ransom, because it harms our business You Have 24 hours to Decide to Pay after 48 hours Decryption Price will Be Double And after 72 hours it will be triple Try to Contact late and You will know Therefore, we recommend that you make payment within a few hours. #deadline You just have 72 hours to send us the Bitcoin after 72 hours we will remove your private key and it's impossible to recover your files #What is Bitcoin? Bitcoin is an innovative payment network and a new kind of money. You can create a Bitcoin account at https://blockchain.info/ and deposit some money into your account and then send to us #How to buy Bitcoin? There are Many way to buy Bitcoin and deposit it into your account, You can buy it with WesternUnion, Bank Wire, International Bank transfer, Cash deposit and etc https://localbitcoins.com ---> Buy Bitcoin with WesternUnion or MoneyGram https://coincafe.com ---> Buy Bitcoin fast and Secure with WesternUnion and Cash deposit https://www.bitstamp.net ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment httos://www.kraken.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment https://www.kraken.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment https://www.ccedk.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment https://bitcurex.com/ ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment If you want to pay with your Business bank account you should create a business account in exchangers they don't accept payment from third party
URLs

  • https://t.me/HELP_DECRYPT_YOUR_FILES

Extracted

Path

  • C:\Users\Public\Desktop\HELP_DECRYPT_YOUR_FILES.txt

Ransom Note
  • All of your important files encrypted with AES-256, RSA-2848 , is a powerful cryptography algorithm For more information you can use Wikipedia *attention: Don't rename or edit encrypted files because it will be impossible to decrypt your files This is a private ransomware developed by our team and there is no decryption file for it For Trust You can Send us Test Files And We Decrypt That And Send To You. *How do I contact you? The only way to communicate is through a secure Telegram messenger Telegram ID : https://t.me/HELP_DECRYPT_YOUR_FILES Your unique Id : VJEDSVMY How To Access Telegram To access Telegram, you must install the version related to your platform You can download Telegram from https://telegram.org #How to recover files? How files are decrypted? What is the decryption file like? Watch file Watch-me.mp4 on each drive and desktop You need two key 1-Public key: you need it for encryption 2-Private Key: you need it for decryption So you need Private key to recover your files. All of your network computers files is encrypted with one public key. So you need just one Private key to recover all computers files The private Key that we will send works on all your computers #How to use private Key? We send you a simple software with private Key And you just need run this software on each computer that encrypted and all affected files will be decrypted *What are the guarantees that I can decrypt my files after paying the ransom? Your main guarantee is the ability to decrypt test files. This means that we can decrypt all your files after paying the ransom. We have no reason to deceive you after receiving the ransom, because it harms our business You Have 24 hours to Decide to Pay after 48 hours Decryption Price will Be Double And after 72 hours it will be triple Try to Contact late and You will know Therefore, we recommend that you make payment within a few hours. #deadline You just have 72 hours to send us the Bitcoin after 72 hours we will remove your private key and it's impossible to recover your files #What is Bitcoin? Bitcoin is an innovative payment network and a new kind of money. You can create a Bitcoin account at https://blockchain.info/ and deposit some money into your account and then send to us #How to buy Bitcoin? There are Many way to buy Bitcoin and deposit it into your account, You can buy it with WesternUnion, Bank Wire, International Bank transfer, Cash deposit and etc https://localbitcoins.com ---> Buy Bitcoin with WesternUnion or MoneyGram https://coincafe.com ---> Buy Bitcoin fast and Secure with WesternUnion and Cash deposit https://www.bitstamp.net ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment httos://www.kraken.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment https://www.kraken.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment https://www.ccedk.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment https://bitcurex.com/ ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment If you want to pay with your Business bank account you should create a business account in exchangers they don't accept payment from third party
URLs

  • https://t.me/HELP_DECRYPT_YOUR_FILES

Extracted

Path

  • C:\Users\Public\Desktop\HELP_DECRYPT_YOUR_FILES.html

Ransom Note
  • <!DOCTYPE html><html><body><div class=demo> <h1>All of your important files encrypted with AES-256, RSA-2848 , is a powerful cryptography algorithm</h1> <p>For more information you can use Wikipedia</p> <p>*attention: Don't rename or edit encrypted files because it will be impossible to decrypt your files</p> <p>This is a private ransomware developed by our team and there is no decryption file for it</p> <br /> <p style=color:#703818;>For Trust You can Send us Test Files And We Decrypt That And Send To You.</p> <br /> <h2>*How do I contact you?</h2> <h2>The only way to communicate is through a secure Telegram messenger</h2> <h2>Telegram ID : https://t.me/HELP_DECRYPT_YOUR_FILES</p> <h2>Your unique Id : VJEDSVMY </h2> <br /><h2>How To Access Telegram</h2> <h2>To access Telegram, you must install the version related to your platform</h2> <h2>You can download Telegram from https://telegram.org</h2> <br /><p>#How to recover files?</p> <br /> <p>How files are decrypted? What is the decryption file like? Watch file Watch-me.mp4 on each drive and desktop</p> <div class=VideoDiv> <video width=400 height=400 controls><source src=C:/Users/Public/Music/video.mp4 type=video/mp4></video></div><br /><p>You need two key</p> <p>1-Public key: you need it for encryption<p>2-Private Key: you need it for decryption</p> <p>All of your network computers files is encrypted with one public key. So you need just one Private key to recover all computers files</p> <p>The private Key that we will send works on all your computers</p> <br /> <p>#How to use private Key?</p> <p>We send you a simple software with private Key</p> <p>And you just need run this software on each computer that encrypted and all affected files will be decrypted</p> <br /> <p>*What are the guarantees that I can decrypt my files after paying the ransom?</p><p>Your main guarantee is the ability to decrypt test files.</p> <p>This means that we can decrypt all your files after paying the ransom.</p> <p>We have no reason to deceive you after receiving the ransom, because it harms our business</p> <p>You Have 24 hours to Decide to Pay</p> <p>after 48 hours Decryption Price will Be Double</p> <p>And after 72 hours it will be triple Try to Contact late and You will know</p> <p>Therefore, we recommend that you make payment within a few hours.</p><br /><p style=color:#d61d1d; >#deadline</p><p>You just have 72 hours to send us the Bitcoin after 72 hours we will remove your private key and it's impossible to recover your files</p><br /><p>#What is Bitcoin?</p><p>Bitcoin is an innovative payment network and a new kind of money.</p><p>You can create a Bitcoin account at https://blockchain.info/ and deposit some money into your account and then send to us</p><br /><p>#How to buy Bitcoin?</p><p>There are Many way to buy Bitcoin and deposit it into your account,</p><p>You can buy it with WesternUnion, Bank Wire, International Bank transfer, Cash deposit and etc</p><p>https://localbitcoins.com ---> Buy Bitcoin with WesternUnion or MoneyGram</p><p>https://coincafe.com ---> Buy Bitcoin fast and Secure with WesternUnion and Cash deposit</p><p>https://www.bitstamp.net ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>httos://www.kraken.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>https://www.kraken.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>https://www.ccedk.com ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>https://bitcurex.com/ ---> Buy Bitcoin with bank wire, International bank transfer, SEPA payment</p><p>If you want to pay with your Business bank account you should create a business account in exchangers they don't accept payment from third party</p></div><style>Demo Styles*/html {height: 100%;box-sizing: border-box;}*,*:before,*:after {box-sizing: inherit;}body {position: relative;margin: 0;padding-bottom: 6rem;min-height: 100%;font-family: Helvetica Neue, Arial, sans-serif;font-weight: bold;background: #000;}.demo {margin: 0 auto;}.demo h1 { margin-top: 15;text-align: center;font-size: 25px;color: #d34410;}.demo h2 { margin-top: 15;text-align: center;font-size: 25px;color: #16419e;}.demo p {margin-top: 10;text-align: center;font-size: 20px;color: #cccccc;}.demo .VideoDiv{margin:0 auto;background:red;border:2px solid #ffffff; width:400px;;height:400px}</style></body></html>
URLs

  • https://t.me/HELP_DECRYPT_YOUR_FILES</p>

Targets

    • Target
      2025-12-10_c3e134d9c151661fb457e1e30d5ea43a_coinminer_sliver_snatch
    • Size 2.9MB
    • SHA256 a6b43e0d4337d7ba8ab0126bf9bcf841238dafb8f2145353400ae788317aeb18
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    credential_accessdefense_evasiondiscoveryexecutionransomwarespywarestealer

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Hide Artifacts: Hidden Files and Directories

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks