Overview

overview

10

Static

static

3

2026-04-02...ar.exe

windows10-2004-x64

10

2026-04-02...ar.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-04-02_457ed0e2f07fd8a1c56c8bd28fd62ac9_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
  • Size 205KB
  • Sample260402-dcgc6abt2n
  • SHA256 ba92248fceb68011cd053541e5a791c9ef00a3275208d55357124ba130d16f33
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
lynxcredential_accessransomwarestealer

Malware Config

Extracted

Path

  • C:\ProgramData\Adobe\Setup\README.txt

Ransom Note
  • Good afternoon, we are Lynx Group. As you can see you have been attacked by us! We offer you to make a deal with us. all you need to do is contact us by following the instructions below. We are not politically motivated group, we are interested only in money, we always keep our word. You have a possibility to decrypt your files and save your reputation in case we find good solution! You have to know we do not like procrastination. You have 7 days to come to the chat room and start negotiations. - 1 Communication Process: In order to contact with us you need to download Tor Browser. You can find out about it across the Internet. After you joined to chat room you have the opportunity to request several things from us for free: 1. make a test decrypt. 2. get a list of the files stolen from you. At the end, we should agree on the price for our services. Keep in mind that we got your income/insurance documents. - 2 Access to the chat room: To access us please use one of the following links: 1. http://lynxchatly4zludmhmi75jrwhycnoqvkxb4prohxmyzf4euf5gjxroad.onion/login 2. http://lynxchatfw4rgsclp4567i4llkqjr2kltaumwwobxdik3qa2oorrknad.onion/login 3. http://lynxchatohmppv6au67lloc2vs6chy7nya7dsu2hhs55mcjxp2joglad.onion/login 4. http://lynxchatbykq2vycvyrtjqb3yuj4ze2wvdubzr2u6b632trwvdbsgmyd.onion/login 5. http://lynxchatde4spv5x6xlwxf47jdo7wtwwgikdoeroxamphu3e7xx5doqd.onion/login 6. http://lynxchatdy3tgcuijsqofhssopcepirjfq2f4pvb5qd4un4dhqyxswqd.onion/login 7. http://lynxchatdykpoelffqlvcbtry6o7gxk3rs2aiagh7ddz5yfttd6quxqd.onion/login If Tor is blocked in your country you can use this link: http://lynxchat.net/login Your unique ID: 69a425ea9c439c5f452c0fab - use it to register in the chat room. - 3 Recommendations: Do not try to recover your files with third-party programs, you will only do harm. Do not turn off / reboot your computer. Do not procrastinate. - 4 Blog: 1: http://lynxblogxstgzsarfyk2pvhdv45igghb4zmthnzmsipzeoduruz3xwqd.onion/ 2: http://lynxblogco7r37jt7p5wrmfxzqze7ghxw6rihzkqc455qluacwotciyd.onion/ 3: http://lynxblogijy4jfoblgix2klxmkbgee4leoeuge7qt4fpfkj4zbi2sjyd.onion/ 4: http://lynxblogmx3rbiwg3rpj4nds25hjsnrwkpxt5gaznetfikz4gz2csyad.onion/ 5: http://lynxblogoxllth4b46cfwlop5pfj4s7dyv37yuy7qn2ftan6gd72hsad.onion/ 6: http://lynxblogtwatfsrwj3oatpejwxk5bngqcd5f7s26iskagfu7ouaomjad.onion/ 7: http://lynxblogxutufossaeawlij3j3uikaloll5ko6grzhkwdclrjngrfoid.onion/
URLs

  • http://lynxchatly4zludmhmi75jrwhycnoqvkxb4prohxmyzf4euf5gjxroad.onion/login

  • http://lynxchatfw4rgsclp4567i4llkqjr2kltaumwwobxdik3qa2oorrknad.onion/login

  • http://lynxchatohmppv6au67lloc2vs6chy7nya7dsu2hhs55mcjxp2joglad.onion/login

  • http://lynxchatbykq2vycvyrtjqb3yuj4ze2wvdubzr2u6b632trwvdbsgmyd.onion/login

  • http://lynxchatde4spv5x6xlwxf47jdo7wtwwgikdoeroxamphu3e7xx5doqd.onion/login

  • http://lynxchatdy3tgcuijsqofhssopcepirjfq2f4pvb5qd4un4dhqyxswqd.onion/login

  • http://lynxchatdykpoelffqlvcbtry6o7gxk3rs2aiagh7ddz5yfttd6quxqd.onion/login

  • http://lynxchat.net/login

  • http://lynxblogxstgzsarfyk2pvhdv45igghb4zmthnzmsipzeoduruz3xwqd.onion/

  • http://lynxblogco7r37jt7p5wrmfxzqze7ghxw6rihzkqc455qluacwotciyd.onion/

  • http://lynxblogijy4jfoblgix2klxmkbgee4leoeuge7qt4fpfkj4zbi2sjyd.onion/

  • http://lynxblogmx3rbiwg3rpj4nds25hjsnrwkpxt5gaznetfikz4gz2csyad.onion/

  • http://lynxblogoxllth4b46cfwlop5pfj4s7dyv37yuy7qn2ftan6gd72hsad.onion/

  • http://lynxblogtwatfsrwj3oatpejwxk5bngqcd5f7s26iskagfu7ouaomjad.onion/

  • http://lynxblogxutufossaeawlij3j3uikaloll5ko6grzhkwdclrjngrfoid.onion/

Targets

    • Target
      2026-04-02_457ed0e2f07fd8a1c56c8bd28fd62ac9_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
    • Size 205KB
    • SHA256 ba92248fceb68011cd053541e5a791c9ef00a3275208d55357124ba130d16f33
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    credential_accesslynxransomwarestealer

    • Lynx

      Lynx is a Windows ransomware which operates using a ransomware-as-a-service model.

      ransomwarelynx

    • Lynx family

      lynx

    • Renames multiple (277) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks