lynx | 73564a7a163223232af8d39e268ce2bc5c6d174c01671f2501d174cedd700681

General

Target
571f5de9dd0d509ed7e5242b9b7473c2b2cbb36ba64d38b32122a0a337d6cf8b.zip
Size 89KB
Sample260602-w65lysdz6n
SHA256 73564a7a163223232af8d39e268ce2bc5c6d174c01671f2501d174cedd700681
MD5 a6df7e3219a8cb1c806e69c7851fc39f
SHA1 f0092148c354a90ed6ae062a5cd30379d2cd5ec6
SHA512 b38b3df3771b4adadae6d21ef849dcabfcd17750bba5272ab042c472d72a908e01674807ce4e0d6d32e9d17ed3e032712697afefcbdfe343cd8f20b5efc71c6b
SSDEEP 1536:dAAynzDt7+s5HaVvVWQD4WkPs5c7t2A+J5dZRjKClpFaHYRWW5WP9X:dEnXtvNa1VWY4/Ps5c7wAON5JpFMPZ
TLSH
T1CE93024634A2C81F8B6512CC112621B68DDE9C7C47CFBE946D117B257F35B52EE13B81
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\ProgramData\Adobe\Setup\README.txt

lynx

Ransom Note

Your data is stolen and encrypted. Download TOR Browser to contact with us. ID ~ 66b33295a3128b53533bd263 Chat site: ~ TOR Network: http://lynxchatly4zludmhmi75jrwhycnoqvkxb4prohxmyzf4euf5gjxroad.onion/login ~ TOR Mirror #1: http://lynxchatfw4rgsclp4567i4llkqjr2kltaumwwobxdik3qa2oorrknad.onion/login ~ TOR Mirror #2: http://lynxchatohmppv6au67lloc2vs6chy7nya7dsu2hhs55mcjxp2joglad.onion/login ~ TOR Mirror #3: http://lynxchatbykq2vycvyrtjqb3yuj4ze2wvdubzr2u6b632trwvdbsgmyd.onion/login ~ TOR Mirror #4: http://lynxchatde4spv5x6xlwxf47jdo7wtwwgikdoeroxamphu3e7xx5doqd.onion/login ~ TOR Mirror #5: http://lynxchatdy3tgcuijsqofhssopcepirjfq2f4pvb5qd4un4dhqyxswqd.onion/login ~ TOR Mirror #6: http://lynxchatdykpoelffqlvcbtry6o7gxk3rs2aiagh7ddz5yfttd6quxqd.onion/login ~ TOR Mirror #7: http://lynxch2k5xi35j7hlbmwl7d6u2oz4vp2wqp6qkwol624cod3d6iqiyqd.onion/login Our blog: ~ TOR Network: http://lynxblogxstgzsarfyk2pvhdv45igghb4zmthnzmsipzeoduruz3xwqd.onion/ ~ TOR Mirror #1: http://lynxblogco7r37jt7p5wrmfxzqze7ghxw6rihzkqc455qluacwotciyd.onion/ ~ TOR Mirror #2: http://lynxblogijy4jfoblgix2klxmkbgee4leoeuge7qt4fpfkj4zbi2sjyd.onion/ ~ TOR Mirror #3: http://lynxblogmx3rbiwg3rpj4nds25hjsnrwkpxt5gaznetfikz4gz2csyad.onion/ ~ TOR Mirror #4: http://lynxblogoxllth4b46cfwlop5pfj4s7dyv37yuy7qn2ftan6gd72hsad.onion/ ~ TOR Mirror #5: http://lynxblogtwatfsrwj3oatpejwxk5bngqcd5f7s26iskagfu7ouaomjad.onion/ ~ TOR Mirror #6: http://lynxblogxutufossaeawlij3j3uikaloll5ko6grzhkwdclrjngrfoid.onion/ ~ Mirror #7: http://lynxblog.net/

URLs

http://lynxchatly4zludmhmi75jrwhycnoqvkxb4prohxmyzf4euf5gjxroad.onion/login
http://lynxchatfw4rgsclp4567i4llkqjr2kltaumwwobxdik3qa2oorrknad.onion/login
http://lynxchatohmppv6au67lloc2vs6chy7nya7dsu2hhs55mcjxp2joglad.onion/login
http://lynxchatbykq2vycvyrtjqb3yuj4ze2wvdubzr2u6b632trwvdbsgmyd.onion/login
http://lynxchatde4spv5x6xlwxf47jdo7wtwwgikdoeroxamphu3e7xx5doqd.onion/login
http://lynxchatdy3tgcuijsqofhssopcepirjfq2f4pvb5qd4un4dhqyxswqd.onion/login
http://lynxchatdykpoelffqlvcbtry6o7gxk3rs2aiagh7ddz5yfttd6quxqd.onion/login
http://lynxch2k5xi35j7hlbmwl7d6u2oz4vp2wqp6qkwol624cod3d6iqiyqd.onion/login
http://lynxblogxstgzsarfyk2pvhdv45igghb4zmthnzmsipzeoduruz3xwqd.onion/
http://lynxblogco7r37jt7p5wrmfxzqze7ghxw6rihzkqc455qluacwotciyd.onion/
http://lynxblogijy4jfoblgix2klxmkbgee4leoeuge7qt4fpfkj4zbi2sjyd.onion/
http://lynxblogmx3rbiwg3rpj4nds25hjsnrwkpxt5gaznetfikz4gz2csyad.onion/
http://lynxblogoxllth4b46cfwlop5pfj4s7dyv37yuy7qn2ftan6gd72hsad.onion/
http://lynxblogtwatfsrwj3oatpejwxk5bngqcd5f7s26iskagfu7ouaomjad.onion/
http://lynxblogxutufossaeawlij3j3uikaloll5ko6grzhkwdclrjngrfoid.onion/
http://lynxblog.net/

Targets

- Target
  571f5de9dd0d509ed7e5242b9b7473c2b2cbb36ba64d38b32122a0a337d6cf8b.exe
- Size 164KB
- SHA256 571f5de9dd0d509ed7e5242b9b7473c2b2cbb36ba64d38b32122a0a337d6cf8b
- MD5 d972bbbb3edb0e5ab5751b911f3dda17
- SHA1 c632223f5f7a8a469bbf07eb017863bb83564b84
- SHA512 41eece9c45422130e67dfd0601966b53f10c8c18522727f7b21928fb40c7046e15871ccf8dd1c77bea8df7970c7539eac217bac24cb598283081697bebc7bd53
- SSDEEP 3072:2jv9TtA6pzarOLgSua/iw6kzgxqexPTjrn7FwhGVKlCTS6D1ftRXFxIAWddPpYXm:27IqexPTjrnp5MSXFVWd5SFlYuTP3R1m
- TLSH
  T185F38C68B3E08035E977183109F4CAF5A97EB8301B11A9DB6B8447765E31AD3C635B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery lynx ransomware stealer
- Family: Lynx
  Lynx is a Windows ransomware which operates using a ransomware-as-a-service model.
  ransomware lynx
- Renames multiple (275) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1