Overview

overview

10

Static

static

10

2026-07-18...lc.exe

windows10-2004-x64

10

2026-07-18...lc.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-07-18_b76dd9d7a576d3653b52d9c4df177a78_cobalt-strike_coinminer_icedid_luca-stealer_njrat_stealc
  • Size 668KB
  • Sample260718-3qqlesh14t
  • SHA256 70d8275a4e3f8b3d99d3b3397d108087e96ac8902cc5eb6a75c05a0ea8ccd87d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
mimikatzdiscoveryransomware

Malware Config

Extracted

Path

  • C:\Users\Admin\Documents\Outlook Files\RECOVERY INFORMATION.txt

Ransom Note
  • Your files have been encrypted To recover them you need decryption tool You can contact us in two ways: 1 Download TOR Browser https://www.torproject.org/download/ (in some cases required VPN to download) Open TOR browser and follow by link below: http://weaxorpemwzoxg5cdvvfd77p3qczkxqii37ww4foo2n4jcft3mytbpyd.onion/lsaHqOhaJLOyrWSPvtJajdzqrftqzOlt/64C0DA20A5499928E9C6975B6DBD44363379953E6799DE6EE1732F40E763D24E 2 Contact by email: [email protected] Your key: 64C0DA20A5499928E9C6975B6DBD44363379953E6799DE6EE1732F40E763D24E Include your key in your letter Our guarantee: we provide free decyrption for 3 files up to 3 megabytes (not zip,db,backup)
URLs

  • http://weaxorpemwzoxg5cdvvfd77p3qczkxqii37ww4foo2n4jcft3mytbpyd.onion/lsaHqOhaJLOyrWSPvtJajdzqrftqzOlt/64C0DA20A5499928E9C6975B6DBD44363379953E6799DE6EE1732F40E763D24E

Extracted

Path

  • C:\Users\Admin\Documents\Outlook Files\RECOVERY INFORMATION.txt

Ransom Note
  • Your files have been encrypted To recover them you need decryption tool You can contact us in two ways: 1 Download TOR Browser https://www.torproject.org/download/ (in some cases required VPN to download) Open TOR browser and follow by link below: http://weaxorpemwzoxg5cdvvfd77p3qczkxqii37ww4foo2n4jcft3mytbpyd.onion/lsaHqOhaJLOyrWSPvtJajdzqrftqzOlt/6BA6EE4B4B548CD55DDB969CDDC1729EC801B1703D36B2F9502236216B7D020F 2 Contact by email: [email protected] Your key: 6BA6EE4B4B548CD55DDB969CDDC1729EC801B1703D36B2F9502236216B7D020F Include your key in your letter Our guarantee: we provide free decyrption for 3 files up to 3 megabytes (not zip,db,backup)
URLs

  • http://weaxorpemwzoxg5cdvvfd77p3qczkxqii37ww4foo2n4jcft3mytbpyd.onion/lsaHqOhaJLOyrWSPvtJajdzqrftqzOlt/6BA6EE4B4B548CD55DDB969CDDC1729EC801B1703D36B2F9502236216B7D020F

Targets

    • Target
      2026-07-18_b76dd9d7a576d3653b52d9c4df177a78_cobalt-strike_coinminer_icedid_luca-stealer_njrat_stealc
    • Size 668KB
    • SHA256 70d8275a4e3f8b3d99d3b3397d108087e96ac8902cc5eb6a75c05a0ea8ccd87d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryransomware

    • Renames multiple (1936) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks