General
- Target 2026-08-06_10d45cfe47e4b1798df32ab479d6298e_cobalt-strike_coinminer_icedid_luca-stealer_njrat_stealc
- Size 668KB
- Sample260806-cpyyascj9y
- SHA256 92dd63b2b06486b6958e852b2194b8f9490341f6b19fd4f21cf276293ff688da
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Documents\Outlook Files\RECOVERY INFORMATION.txt
Ransom Note
- Your files have been encrypted To recover them you need decryption tool You can contact us in two ways: 1 Download TOR Browser https://www.torproject.org/download/ (in some cases required VPN to download) Open TOR browser and follow by link below: http://weaxorpemwzoxg5cdvvfd77p3qczkxqii37ww4foo2n4jcft3mytbpyd.onion/lsaHqOhaJLOyrWSPvtJajdzqrftqzOlt/0BFE7C4E33A44C4937B094BBD523AF80BEA5D0A6107251B9E2A2705EB22DC5F0 2 Contact by email: [email protected] Your key: 0BFE7C4E33A44C4937B094BBD523AF80BEA5D0A6107251B9E2A2705EB22DC5F0 Include your key in your letter Our guarantee: we provide free decyrption for 3 files up to 3 megabytes (not zip,db,backup)
Emails
URLs
-
http://weaxorpemwzoxg5cdvvfd77p3qczkxqii37ww4foo2n4jcft3mytbpyd.onion/lsaHqOhaJLOyrWSPvtJajdzqrftqzOlt/0BFE7C4E33A44C4937B094BBD523AF80BEA5D0A6107251B9E2A2705EB22DC5F0
Targets
-
- Target 2026-08-06_10d45cfe47e4b1798df32ab479d6298e_cobalt-strike_coinminer_icedid_luca-stealer_njrat_stealc
- Size 668KB
- SHA256 92dd63b2b06486b6958e852b2194b8f9490341f6b19fd4f21cf276293ff688da
Score10/10-
Renames multiple (1910) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.