Overview

overview

10

Static

static

10

2026-07-07...x_.exe

windows10-2004-x64

10

2026-07-07...x_.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-07-07_cb80eeabade0cea198b289ceda1b0e54_amadey_avoslocker_cobalt-strike_coinminer_darkgate_elex_graphican_koxic_luca-stealer_lynx_njrat
  • Size 386KB
  • Sample260707-lybzkae191
  • SHA256 3f914046b8d3ff3ed71a842b69c917b0774b48b5e69f1f8460c3badeee66d7fb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
koxicdefense_evasiondiscoveryevasionransomwaretrojan

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\WANNA_RECOVER_KOXIC_FILEZ_PMPTQ.txt

Ransom Note
  • --=== Hello ===--- [+] Whats Happen? [+] Your sensitive information and data were downloaded. Your files are encrypted, and currently unavailable just so you can contact us faster. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] We are not interested in distributing information, we are interested in agreeing with you - these are your guarantees. Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should send sample to us to decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise-time is much more valuable than money. [+] How to contact us? [+] Just write us an email to [email protected] [+] Consequences if we do not find a common language [+] 1. The data were irretrievably lost. 2. Leaked data will be published or sold on blmarket (or to competitors). 3. In some cases, DDOS attacks will be applied to your inftastructure. !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! Your UserID: 85DF906F460FD82397E62F9C931188275401F78405292473D936EBB78A1A37E8225EE653BED2B9A380 EEFACD413A3B00184DF6D9966CAEEE8153EFF503F8A5AA55440E8B708A3F4E41047F3DF2F764CBE872 931D82376689416898BD41D9230EA67847785D8F372941CB4D562B708B1D386B6A818B872072156E94 72FED568F9718F024EFA8BC51C7849AF1BA5355664A2E75E34C88AF2B002448FEEFC985408065B9555 8CDF7FFF95486C09DE0DEC1B59C22D6945C3102AFB6E1F520BF912BC0EB9AFDEC8737A35F1FA2AA059 774A52DA24DA2B773409C22E7DCF35D9055204FD4356D70224EBE303AB81666B03B24F35A4A9E45E05 0F024CB75FF0C3B0BB0B3082010A0282010100A530EAC4109B8687091FB1701DBFE41A78D2D75EE473 C2AE44675E53B01F5182EF21D3B175CC4C52504E0D77B78EE094A337DC94B933A9B208EE30A47295DF 8B0D7C9A395499ACE97941702A7E1AD2D579048DB8884BAE11A8DD55ECF4C41302E685D14D744E0545 10F8CB370DBEEE7EB9A86CD75B4BA3F85AD090173A529A496DBCBE1AEC2BB624AE0D7099AF1DF2EFD2 9CD67D2F2579799928D7871A80BD9CEC5CD24885D160BC6FD0AA780BB9B4C465E42D968ECC97159607 BBBBEBD74681D6FDA6A8FCFEFC804520AC4CF4524F6476F28F502593DAA5F0574D90819BF564328EFA AF6B1D58C0A9304DA86709C9446E96FE9DD7D994F8B16DEF94F244292B020301000169DC401CBC2477 632B23C4CA9F5BCB1E504D505451

Extracted

Path

  • C:\Users\Admin\AppData\Local\Adobe\WANNA_RECOVER_KOXIC_FILEZ_RJKGM.txt

Ransom Note
  • --=== Hello ===--- [+] Whats Happen? [+] Your sensitive information and data were downloaded. Your files are encrypted, and currently unavailable just so you can contact us faster. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] We are not interested in distributing information, we are interested in agreeing with you - these are your guarantees. Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should send sample to us to decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise-time is much more valuable than money. [+] How to contact us? [+] Just write us an email to [email protected] [+] Consequences if we do not find a common language [+] 1. The data were irretrievably lost. 2. Leaked data will be published or sold on blmarket (or to competitors). 3. In some cases, DDOS attacks will be applied to your inftastructure. !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! Your UserID: 6EB55FB9E75D2FFDF67F95981E70EC174C65E0AE0B081A5B3EEEA0DA085E791D85A3D2C20904B902E6 1AB0BA9606981D5CFAA2184904CB8CDF1765851197026C98A6C32A308A34D763C3B2EFBECB319DB2DB 10AA1607174441D78FCE3094CB4C91C5D04CB77E0F00A746EC5D81DD584BEAEF3E6547D279BDDAA291 1374B13E91322C4251F6BC6AD45AC06996943CD8E1D3585F77FCD034244AF6EE3840BA7CD65E3310E2 124A0F672DE4273DE9B8EED5DA4B86CF652A8F180100772B79BB5B0C510E3B151E6B5F23B654CDA330 1955A6AC07D376C5543D0A55619C93D203F401076DAD0E474F55812714CB12BD9B603DE383009ED966 60D3D8F20BE887C4B2403082010A0282010100981AB6387F607C1FB645EF8AD76788F2A545957D64D5 3F4E0F76232564B2061A52213DE30554EA22A2B54998915954ED42BC6843BDF903D3FA7D38FD563995 60DF63E0F10BE8D41BDC0B9DD5BFA2A40ED6FBE88790BB94E0755F361DA80921925DB7CA070ACDCA03 32E2DBCBC39D63AFD0B32221E9ED258256C9CC74893166E5DA30FB46C68BBCEF26DF4A7EE64436591B 6358358AF306C85206ABFB5156E15ACC4CD9D00A961B4F54FE87D65E1A97D95AB1986ED62D49336DF4 E78DD895019366777C61982C1A6F1E077AE5037B2ADECECE32908488EE233BE9F6B2E9A2028EBCC119 D68AD68259F6EFD19BFB3FA75402087B953F340A3C9DF382CECC19762702030100013D2B7408010BE2 E1BBDF54E5137C0DD0524A4B474D

Targets

    • Target
      2026-07-07_cb80eeabade0cea198b289ceda1b0e54_amadey_avoslocker_cobalt-strike_coinminer_darkgate_elex_graphican_koxic_luca-stealer_lynx_njrat
    • Size 386KB
    • SHA256 3f914046b8d3ff3ed71a842b69c917b0774b48b5e69f1f8460c3badeee66d7fb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryevasionkoxicransomwaretrojan

    • Family: Koxic

      A C++ written ransomware first seen in late 2021.

      ransomwarekoxic

    • Modifies Windows Defender DisableAntiSpyware settings

      evasiontrojan

    • Modifies Windows Defender Real-time Protection settings

      defense_evasiontrojan

    • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

    • Renames multiple (15272) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Disables taskbar notifications via registry modification

      defense_evasion

    • Windows security modification

      defense_evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks