General
- Target a34acd47127196ab867d572c2c6cf2fcccffa3a7a87e82d338a8efed898ca722.exe
- Size 3.0MB
- Sample260223-qmjmgsdx2e
- SHA256 a34acd47127196ab867d572c2c6cf2fcccffa3a7a87e82d338a8efed898ca722
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Videos\recover.txt
Ransom Note
- Dear Shelbourne Accountants Team: We're Cephalus, 100% financial motivated. We're sorry to tell you that your intranet has been compromised by us, and we have stolen confidential data from your intranet, including your confidential clients, contacts and matters etc. We've taken down your whole domain control, all your past and ongoing matters and client list are in our hands. Files on your APP-SERVER,SERVER-2016 has been taken from us, as you know , clients data and other credential files are within. Before 08/28/2025 you should contact us , the earlier you contact us , the smaller the problem will be. After that your data will be uploaded, your competitors, partners, clients, authorities, tax agenesis and lawyer would be able to access it. We will start mailing and calling your clients. Those who didn't follow our orders have already be in trouble , check your peer SSKRPLAW and other companies as you search us with "Cephalus data leak" or just simply pay a visit to our tor website: http://cephalus6oiypuwumqlwurvbmwsfglg424zjdmywfgqm4iehkqivsjyd.onion Or that will not happen, If we will close this deal in time!!! If you want the proof , the following links are filelists in your intranet : https://gofile.io/d/fixCg7 Our business depends on the reputation even more than many others. If we will take money and spread your information - we will have issues with payments in future. So, we will stick to our promises and reputation. That works in both ways: if we said that we will email all your staff and publicly spread all your data - we will. Now WE're using an officer's account to contact you , but we'll move onto other connection as the following , Here are a few ways to get in touch with us. 1. Tox:91C24CC1586713CA606047297516AF534FE57EFA8C3EA2031B7DF8D116AC751B156869CB8838 Link to download Tox: https://github.com/qTox/qTox/releases/download/v1.17.6/setup-qtox-x86_64-release.exe 2. Email:[email protected] Don't do any silly things, don't treat it lightly too. We got proofs that your data was kept with a number of data security violations of data breach laws. The penalty payments would be huge if we will anonymously sent our briefs and notes about your network structure to the regulators. Embrace it and pay us. After that your data will be erased from our systems, with proof's provided to you. Also you might request your network improvement report. Based on your position in the company call your management to speak. DO NOT try to speak speak instead of your superiors, based on our experience, that may lead to disaster. Your ID: 29a9bb2bd0eedf7b3574c380d6fa0373 Now you should contact us.
Emails
-
Email:[email protected]
URLs
-
http://cephalus6oiypuwumqlwurvbmwsfglg424zjdmywfgqm4iehkqivsjyd.onion
-
https://gofile.io/d/fixCg7
-
https://github.com/qTox/qTox/releases/download/v1.17.6/setup-qtox-x86_64-release.exe
Targets
-
- Target a34acd47127196ab867d572c2c6cf2fcccffa3a7a87e82d338a8efed898ca722.exe
- Size 3.0MB
- SHA256 a34acd47127196ab867d572c2c6cf2fcccffa3a7a87e82d338a8efed898ca722
Score10/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (158) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.