Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://github.com/D...

windows10-2004-x64

Resubmissions

20/06/2026, 14:31

260620-rvzjcafv5n

20/06/2026, 14:25

260620-rrj99afv4m10

Sharing

Copy URL Twitter E-mail

General

  • Target
    https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/Locky.AZ.exe
  • Sample260620-rrj99afv4m
Score
10/10
metasploitbackdoorbootkitdiscoverypersistenceransomwarespywarestealertrojan

Malware Config

Extracted

Family

  • metasploit

Version

  • windows/single_exec

Extracted

Path

  • C:\Users\Public\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note
  • You became victim of the GOLDENEYE RANSOMWARE! The files on your computer have been encrypted with an military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the darknet page shown in step 2. To purchase your key and restore your data, please follow these three easy steps: 1. Download the Tor Browser at "https://www.torproject.org/". If you need help, please google for "access onion page". 2. Visit one of the following pages with the Tor Browser: http://golden5a4eqranh7.onion/wSSEnn6B http://goldeny4vs3nyoht.onion/wSSEnn6B 3. Enter your personal decryption code there: wSSEnn6Bf4krgdi1cCmZWUh5sayVudipBxsdawazsuiNVXtPKLNSmwwbBGi3fJpPg4sQ1Gq2FbTZYBNyJMRzVoBBbkm9WzEq
URLs

  • http://golden5a4eqranh7.onion/wSSEnn6B

  • http://goldeny4vs3nyoht.onion/wSSEnn6B

Targets

    • Target
      https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/Locky.AZ.exe
    Score
    10/10
    backdoorbootkitdiscoverymetasploitpersistenceransomwarespywarestealertrojan

    • Family: MetaSploit

      Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

      trojanbackdoormetasploit

    • Renames multiple (157) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks