Overview

overview

10

Static

static

10

2026-07-18...lc.exe

windows10-2004-x64

10

2026-07-18...lc.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-07-18_cc24ad94decbeb66524661ad205cedaa_cobalt-strike_coinminer_icedid_luca-stealer_njrat_stealc
  • Size 668KB
  • Sample260718-3p4fwsft7j
  • SHA256 caf12dc6939adf8fd71cdb2341a6509841ac338b734812d4fb6c2b9ff6db9e9c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
mimikatzdiscoveryransomware

Malware Config

Extracted

Path

  • C:\Users\Admin\Documents\Outlook Files\RECOVERY INFORMATION.txt

Ransom Note
  • Your files have been encrypted To recover them you need decryption tool You can contact us in two ways: 1 Download TOR Browser https://www.torproject.org/download/ (in some cases required VPN to download) Open TOR browser and follow by link below: http://weaxorpemwzoxg5cdvvfd77p3qczkxqii37ww4foo2n4jcft3mytbpyd.onion/lsaHqOhaJLOyrWSPvtJajdzqrftqzOlt/594276092A33EA30239A67F10CBCF573DBF3290305594E34AE7EBEF091F08633 2 Contact by email: [email protected] Your key: 594276092A33EA30239A67F10CBCF573DBF3290305594E34AE7EBEF091F08633 Include your key in your letter Our guarantee: we provide free decyrption for 3 files up to 3 megabytes (not zip,db,backup)
URLs

  • http://weaxorpemwzoxg5cdvvfd77p3qczkxqii37ww4foo2n4jcft3mytbpyd.onion/lsaHqOhaJLOyrWSPvtJajdzqrftqzOlt/594276092A33EA30239A67F10CBCF573DBF3290305594E34AE7EBEF091F08633

Extracted

Path

  • C:\Users\Admin\Documents\Outlook Files\RECOVERY INFORMATION.txt

Ransom Note
  • Your files have been encrypted To recover them you need decryption tool You can contact us in two ways: 1 Download TOR Browser https://www.torproject.org/download/ (in some cases required VPN to download) Open TOR browser and follow by link below: http://weaxorpemwzoxg5cdvvfd77p3qczkxqii37ww4foo2n4jcft3mytbpyd.onion/lsaHqOhaJLOyrWSPvtJajdzqrftqzOlt/250B6477945FD52EFB6EFB3042547298A1E354053EC1342A5CE8E665D61F9796 2 Contact by email: [email protected] Your key: 250B6477945FD52EFB6EFB3042547298A1E354053EC1342A5CE8E665D61F9796 Include your key in your letter Our guarantee: we provide free decyrption for 3 files up to 3 megabytes (not zip,db,backup)
URLs

  • http://weaxorpemwzoxg5cdvvfd77p3qczkxqii37ww4foo2n4jcft3mytbpyd.onion/lsaHqOhaJLOyrWSPvtJajdzqrftqzOlt/250B6477945FD52EFB6EFB3042547298A1E354053EC1342A5CE8E665D61F9796

Targets

    • Target
      2026-07-18_cc24ad94decbeb66524661ad205cedaa_cobalt-strike_coinminer_icedid_luca-stealer_njrat_stealc
    • Size 668KB
    • SHA256 caf12dc6939adf8fd71cdb2341a6509841ac338b734812d4fb6c2b9ff6db9e9c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryransomware

    • Renames multiple (1916) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks