Overview

overview

10

Static

static

3

977705a055...a1.exe

windows10-2004-x64

10

977705a055...a1.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    977705a055599b61d5235c34aa5deadd6da0e884652306f802abeedde466d6a1
  • Size 51.8MB
  • Sample260401-tealdsg17y
  • SHA256 977705a055599b61d5235c34aa5deadd6da0e884652306f802abeedde466d6a1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
charonransomware

Malware Config

Extracted

Path

  • C:\Users\Admin\How To Restore Your Files.txt

  • charon

Ransom Note
  • ================================================================================ ATTENTION Egyptair YOUR NETWORK HAS BEEN COMPROMISED ================================================================================ Dear Egyptair Management, Your corporate network has been successfully infiltrated and encrypted by our advanced ransomware system. All critical business data, including: • Financial records and accounting databases • Customer information and contact lists • Employee personal data and HR records • Proprietary software and source code • Business contracts and legal documents • Email archives and communication logs • Backup systems and recovery files ...have been ENCRYPTED and are currently INACCESSIBLE. ================================================================================ WHAT HAPPENED? ================================================================================ Our team has gained complete access to your network infrastructure through sophisticated penetration techniques. We have: 1. Encrypted all critical business files using military-grade encryption 2. Exfiltrated sensitive data as insurance against non-payment 3. Disabled your backup and recovery systems 4. Maintained persistent access to your network Your current security measures were insufficient to prevent this breach. ================================================================================ RECOVERY OPTIONS ================================================================================ You have TWO options to recover your data: OPTION 1: Pay the ransom fee of $500,000 USD in Bitcoin - Fast and guaranteed recovery of all encrypted files - Deletion of all exfiltrated data from our servers - Complete removal of our access from your systems - Detailed security report to prevent future breaches OPTION 2: Attempt recovery without payment - Risk permanent data loss - Potential public release of sensitive information - Continued vulnerability to future attacks - Significant business disruption and downtime ================================================================================ PAYMENT DETAILS ================================================================================ Ransom Amount: $500,000 USD (Bitcoin equivalent) Payment Deadline: 72 hours from this notice Bitcoin Wallet Address: bc1qzhnwl8dx5c7rekplhn4vq7jjxee6depthy9f98 Current Bitcoin Price: Check https://coinbase.com or https://blockchain.info Payment Confirmation: Send transaction ID to [email protected] ================================================================================ IMPORTANT WARNINGS ================================================================================ ⚠️ DO NOT attempt to decrypt files yourself - this may cause permanent damage ⚠️ DO NOT contact law enforcement - this will result in data publication ⚠️ DO NOT ignore this message - deadline is strictly enforced ⚠️ DO NOT try to restore from backups - they have been compromised ================================================================================ PROOF OF ACCESS ================================================================================ As proof of our capabilities, we have prepared samples of your encrypted data: • [SAMPLE_FILE_1] - Encrypted on [DATE] • [SAMPLE_FILE_2] - Encrypted on [DATE] • [SAMPLE_FILE_3] - Encrypted on [DATE] We can provide decryption of 2-3 small files as proof that recovery is possible. Send your test files to [email protected] with subject "PROOF REQUEST". ================================================================================ CONTACT INFORMATION ================================================================================ For payment confirmation and decryption key delivery: Email: [email protected] Tox: 42E4DD67CCFDA605BC8F578BA1D47F05250B52EF388C28882A7A1052AFD33126DEB96372BE58 Subject Line: "Egyptair - Payment Confirmation" Response Time: 12-24 hours Languages: English, Spanish, French, German, Russian, Chinese ================================================================================ BUSINESS CONTINUITY ================================================================================ We understand the critical nature of your business operations. Upon payment: 1. You will receive the master decryption key within 6 hours 2. Step-by-step recovery instructions will be provided 3. Technical support will be available during recovery 4. All exfiltrated data will be securely deleted 5. Security recommendations will be provided ================================================================================ FREQUENTLY ASKED QUESTIONS ================================================================================ Q: Can we negotiate the price? A: The price is final and non-negotiable(Except in special circumstances). Q: How do we know you'll provide the decryption key? A: Our reputation depends on successful transactions. We always deliver. Q: What if we pay but don't receive the key? A: This has never happened. We provide 24/7 support until full recovery. Q: Can we recover without paying? A: Technically impossible. Our encryption is unbreakable without the key. Q: Will you attack us again? A: No. Payment includes permanent removal from our target list. ================================================================================ FINAL WARNING ================================================================================ This is a business transaction, not a personal attack. We are professionals who simply want to be compensated for demonstrating your security weaknesses. Your cooperation will ensure: ✓ Quick resolution of this incident ✓ Complete data recovery ✓ Minimal business disruption ✓ Confidential handling of this matter Failure to cooperate will result in: ✗ Permanent data loss ✗ Public exposure of sensitive information ✗ Significant financial and reputational damage ✗ Potential legal complications ================================================================================ Time is critical. Contact us immediately at [email protected] Remember: We are your ONLY option for data recovery. ================================================================================ This message will self-destruct in 72 hours ================================================================================
URLs

  • https://coinbase.com

Targets

    • Target
      977705a055599b61d5235c34aa5deadd6da0e884652306f802abeedde466d6a1
    • Size 51.8MB
    • SHA256 977705a055599b61d5235c34aa5deadd6da0e884652306f802abeedde466d6a1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    charonransomware

    • Charon

      Charon is a Windows Ransomware.

      ransomwarecharon

    • Charon family

      charon

    • Renames multiple (140) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks