General
- Target 2026-07-05_f731f3a729220b6ae75fc4281fe4a484_akira_elex_glassworm_qilin
- Size 4.0MB
- Sample260705-bdlyxsfx7z
- SHA256 ffa64e2cde5ccf52b41e41d5b240c2dcfafedeb6cf529d99211458f903afe3e2
Malware Config
Extracted
-
agenda
-
company_id
y4VXdn8MC4
-
note
-- Qilin Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from you system/network If you refuse to communicate with us and we do not come to an agreement, your data will be published. Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials-- Credentials Extension: y4VXdn8MC4 Domain: hk7i336pkcra3lromcoj3szxg6ag36d3b66gef7mrjyigpd35lk44pqd.onion login: twwiUS13QnrkN_bMyLV9vAQ50ntyBtXH password:
Targets
-
- Target 2026-07-05_f731f3a729220b6ae75fc4281fe4a484_akira_elex_glassworm_qilin
- Size 4.0MB
- SHA256 ffa64e2cde5ccf52b41e41d5b240c2dcfafedeb6cf529d99211458f903afe3e2
Score10/10-
Family: Agenda Ransomware
A ransomware with multiple variants written in Golang and Rust first seen in August 2022.
-
Detects command variations typically used by ransomware
-
Detects executables containing many references to VEEAM. Observed in ransomware
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.