General
- Target https://github.com/Dream09e/Petya
- Sample260620-dpth9acy9p
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Public\YOUR_FILES_ARE_ENCRYPTED.TXT
Ransom Note
- You became victim of the GOLDENEYE RANSOMWARE! The files on your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page shown in step 2. To purchase your key and restore your data, please follow these three easy steps: 1. Download the Tor Browser at "https://www.torproject.org/". If you need help, please google for "access onion page". 2. Visit one of the following pages with the Tor Browser: http://golden5a4eqranh7.onion/tzaciVr8 http://goldeny4vs3nyoht.onion/tzaciVr8 3. Enter your personal decryption code there: tzaciVr889WXfeE7z34uwZVzgoccEibkTcWezL9Db92gkEiajXmo1ARKPywXyi7VVQM7w8XCfQygo3p5pNM2PAXufNdfQKdQ
URLs
-
http://golden5a4eqranh7.onion/tzaciVr8
-
http://goldeny4vs3nyoht.onion/tzaciVr8
Extracted
Family
-
metasploit
Version
-
windows/single_exec
Targets
-
- Target https://github.com/Dream09e/Petya
Score10/10-
Family: MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Downloads MZ/PE file
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
System Binary Proxy Execution: Verclsid
Adversaries may abuse Verclsid to proxy execution of malicious code.