Overview

overview

10

Static

static

3

2026-01-05...ee.exe

windows10-2004-x64

10

2026-01-05...ee.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-01-05_0d7bc40d75bdc0481ac3077ee9cb05a5_elex_rhadamanthys_smoke-loader_stop_tofsee
  • Size 147KB
  • Sample260105-hh6mfsbl71
  • SHA256 c798d1f5aac1358df9705579df5e73ec229aef13165d3be95c6de4a091a16143
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
seondiscoveryransomwarespywarestealertrojan

Malware Config

Extracted

Path

  • C:\Users\Public\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note
  • You became victim of the GOLDENEYE RANSOMWARE! The files on your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page shown in step 2. To purchase your key and restore your data, please follow these three easy steps: 1. Download the Tor Browser at "https://www.torproject.org/". If you need help, please google for "access onion page". 2. Visit one of the following pages with the Tor Browser: http://golden5a4eqranh7.onion/tJtJWqiF http://goldeny4vs3nyoht.onion/tJtJWqiF 3. Enter your personal decryption code there: tJtJWqiFVPvPehtDYaDDk6vQ7XbnthJNACVitbLt6ASvRaBYSeEtTXrK9uBuYtrmDSnSoY1Uw4QecFs3URB6iEg517krt19c
URLs

  • http://golden5a4eqranh7.onion/tJtJWqiF

  • http://goldeny4vs3nyoht.onion/tJtJWqiF

Extracted

Path

  • C:\Users\Public\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note
  • You became victim of the GOLDENEYE RANSOMWARE! The files on your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page shown in step 2. To purchase your key and restore your data, please follow these three easy steps: 1. Download the Tor Browser at "https://www.torproject.org/". If you need help, please google for "access onion page". 2. Visit one of the following pages with the Tor Browser: http://golden5a4eqranh7.onion/qX51qJmi http://goldeny4vs3nyoht.onion/qX51qJmi 3. Enter your personal decryption code there: qX51qJmijXTSnSLV97b6rjzSz8PHSfYgb8nnXgexwCeVr3g7TDi1zULVpY7jQyDNuvBpf2SmGRbuWrbU9hm27MivAzui8fxN
URLs

  • http://golden5a4eqranh7.onion/qX51qJmi

  • http://goldeny4vs3nyoht.onion/qX51qJmi

Targets

    • Target
      2026-01-05_0d7bc40d75bdc0481ac3077ee9cb05a5_elex_rhadamanthys_smoke-loader_stop_tofsee
    • Size 147KB
    • SHA256 c798d1f5aac1358df9705579df5e73ec229aef13165d3be95c6de4a091a16143
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryseonransomwarespywarestealertrojan

    • Seon

      The Seon Ransomware is an encryption ransomware Trojan first observed on November 14, 2018.

      trojanransomwareseon

    • Seon family

      seon

    • Renames multiple (1039) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks