General
- Target 80711e37f2_b64_decoded_exe
- Size 113KB
- Sample260608-lr98sacv2z
- SHA256 80711e37f226ef1dc86dc80a8cbc0b2ec895b361e9ade85da793d94b1d876be8
Score
10/10
Malware Config
Extracted
Path
-
C:\Recovery\WindowsRE\How To Restore Your Files.txt
-
charon
Ransom Note
- ================================================================================ ATTENTION Egyptair YOUR NETWORK HAS BEEN COMPROMISED ================================================================================ Dear Egyptair Management, Your corporate network has been successfully infiltrated and encrypted by our advanced ransomware system. All critical business data, including: • Financial records and accounting databases • Customer information and contact lists • Employee personal data and HR records • Proprietary software and source code • Business contracts and legal documents • Email archives and communication logs • Backup systems and recovery files ...have been ENCRYPTED and are currently INACCESSIBLE. ================================================================================ WHAT HAPPENED? ================================================================================ Our team has gained complete access to your network infrastructure through sophisticated penetration techniques. We have: 1. Encrypted all critical business files using military-grade encryption 2. Exfiltrated sensitive data as insurance against non-payment 3. Disabled your backup and recovery systems 4. Maintained persistent access to your network Your current security measures were insufficient to prevent this breach. ================================================================================ RECOVERY OPTIONS ================================================================================ You have TWO options to recover your data: OPTION 1: Pay the ransom fee of $500,000 USD in Bitcoin - Fast and guaranteed recovery of all encrypted files - Deletion of all exfiltrated data from our servers - Complete removal of our access from your systems - Detailed security report to prevent future breaches OPTION 2: Attempt recovery without payment - Risk permanent data loss - Potential public release of sensitive information - Continued vulnerability to future attacks - Significant business disruption and downtime ================================================================================ PAYMENT DETAILS ================================================================================ Ransom Amount: $500,000 USD (Bitcoin equivalent) Payment Deadline: 72 hours from this notice Bitcoin Wallet Address: bc1qzhnwl8dx5c7rekplhn4vq7jjxee6depthy9f98 Current Bitcoin Price: Check https://coinbase.com or https://blockchain.info Payment Confirmation: Send transaction ID to [email protected] ================================================================================ IMPORTANT WARNINGS ================================================================================ ⚠️ DO NOT attempt to decrypt files yourself - this may cause permanent damage ⚠️ DO NOT contact law enforcement - this will result in data publication ⚠️ DO NOT ignore this message - deadline is strictly enforced ⚠️ DO NOT try to restore from backups - they have been compromised ================================================================================ PROOF OF ACCESS ================================================================================ As proof of our capabilities, we have prepared samples of your encrypted data: • [SAMPLE_FILE_1] - Encrypted on [DATE] • [SAMPLE_FILE_2] - Encrypted on [DATE] • [SAMPLE_FILE_3] - Encrypted on [DATE] We can provide decryption of 2-3 small files as proof that recovery is possible. Send your test files to [email protected] with subject "PROOF REQUEST". ================================================================================ CONTACT INFORMATION ================================================================================ For payment confirmation and decryption key delivery: Email: [email protected] Tox: 42E4DD67CCFDA605BC8F578BA1D47F05250B52EF388C28882A7A1052AFD33126DEB96372BE58 Subject Line: "Egyptair - Payment Confirmation" Response Time: 12-24 hours Languages: English, Spanish, French, German, Russian, Chinese ================================================================================ BUSINESS CONTINUITY ================================================================================ We understand the critical nature of your business operations. Upon payment: 1. You will receive the master decryption key within 6 hours 2. Step-by-step recovery instructions will be provided 3. Technical support will be available during recovery 4. All exfiltrated data will be securely deleted 5. Security recommendations will be provided ================================================================================ FREQUENTLY ASKED QUESTIONS ================================================================================ Q: Can we negotiate the price? A: The price is final and non-negotiable(Except in special circumstances). Q: How do we know you'll provide the decryption key? A: Our reputation depends on successful transactions. We always deliver. Q: What if we pay but don't receive the key? A: This has never happened. We provide 24/7 support until full recovery. Q: Can we recover without paying? A: Technically impossible. Our encryption is unbreakable without the key. Q: Will you attack us again? A: No. Payment includes permanent removal from our target list. ================================================================================ FINAL WARNING ================================================================================ This is a business transaction, not a personal attack. We are professionals who simply want to be compensated for demonstrating your security weaknesses. Your cooperation will ensure: ✓ Quick resolution of this incident ✓ Complete data recovery ✓ Minimal business disruption ✓ Confidential handling of this matter Failure to cooperate will result in: ✗ Permanent data loss ✗ Public exposure of sensitive information ✗ Significant financial and reputational damage ✗ Potential legal complications ================================================================================ Time is critical. Contact us immediately at [email protected] Remember: We are your ONLY option for data recovery. ================================================================================ This message will self-destruct in 72 hours ================================================================================
Emails
URLs
-
https://coinbase.com
Targets
-
- Target 80711e37f2_b64_decoded_exe
- Size 113KB
- SHA256 80711e37f226ef1dc86dc80a8cbc0b2ec895b361e9ade85da793d94b1d876be8
Score10/10-
Family: Charon
Charon is a Windows Ransomware.
-
Renames multiple (134) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.