Overview

overview

10

Static

static

3

hola.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    hola.exe
  • Size 123KB
  • Sample260313-xfkdrscy4n
  • SHA256 96423b6e7aafabf85099e0e3fffc5a720808636cc28a36a99b000f21c09ae0c2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
petyaseonbootkitdefense_evasionpersistenceransomwaretrojan

Malware Config

Extracted

Path

  • C:\Users\Admin\Desktop\README_YOUR_FILES_ARE_ENCRYPTED.txt

Ransom Note
  • !!! YOUR FILES HAVE BEEN ENCRYPTED !!! Your personal files have been encrypted with Rombank ransomware. You have 48 hours to pay the ransom or your files will be permanently deleted. To decrypt your files: 1. Send 0.1 BTC to: 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa 2. Email your payment receipt to: [email protected] 3. You will receive the decryptor.exe tool Personal ID: 4D8732CAFC80179F896E58D1B00A820F DO NOT TRY TO DECRYPT YOURSELF - ALL FILES WILL BE DELETED!
Wallets

  • 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa

Targets

    • Target
      hola.exe
    • Size 123KB
    • SHA256 96423b6e7aafabf85099e0e3fffc5a720808636cc28a36a99b000f21c09ae0c2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    bootkitdefense_evasionpetyaseonpersistenceransomwaretrojan

    • Detects Petya Ransomware

      ransomware

    • Petya

      Petya is a ransomware written in C#.

      ransomwarepetya

    • Petya family

      petya

    • Seon

      The Seon Ransomware is an encryption ransomware Trojan first observed on November 14, 2018.

      trojanransomwareseon

    • Seon family

      seon

    • Renames multiple (53) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Executes dropped EXE

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks