General
- Target 2026-08-07_58d4294b32b94bbaee3d64c5b88dd371_cobalt-strike_coinminer_icedid_luca-stealer_njrat_stealc
- Size 668KB
- Sample260808-bpx6bsfk9y
- SHA256 4b03cd6348172b97cd8e0e2eba81316c4a6402b3a70e10b2c36bd29dd0e2638f
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Documents\Outlook Files\RECOVERY INFORMATION.txt
Ransom Note
- Your files have been encrypted To recover them you need decryption tool You can contact us in two ways: 1 Download TOR Browser https://www.torproject.org/download/ (in some cases required VPN to download) Open TOR browser and follow by link below: http://weaxorpemwzoxg5cdvvfd77p3qczkxqii37ww4foo2n4jcft3mytbpyd.onion/lsaHqOhaJLOyrWSPvtJajdzqrftqzOlt/7D54271E45106FA0DDE5FC89256B06DF1E6237511B5EDFA1E887C33AA78B46C4 2 Contact by email: [email protected] Your key: 7D54271E45106FA0DDE5FC89256B06DF1E6237511B5EDFA1E887C33AA78B46C4 Include your key in your letter Our guarantee: we provide free decyrption for 3 files up to 3 megabytes (not zip,db,backup)
Emails
URLs
-
http://weaxorpemwzoxg5cdvvfd77p3qczkxqii37ww4foo2n4jcft3mytbpyd.onion/lsaHqOhaJLOyrWSPvtJajdzqrftqzOlt/7D54271E45106FA0DDE5FC89256B06DF1E6237511B5EDFA1E887C33AA78B46C4
Extracted
Path
-
C:\Users\Admin\Documents\Outlook Files\RECOVERY INFORMATION.txt
Ransom Note
- Your files have been encrypted To recover them you need decryption tool You can contact us in two ways: 1 Download TOR Browser https://www.torproject.org/download/ (in some cases required VPN to download) Open TOR browser and follow by link below: http://weaxorpemwzoxg5cdvvfd77p3qczkxqii37ww4foo2n4jcft3mytbpyd.onion/lsaHqOhaJLOyrWSPvtJajdzqrftqzOlt/2AEA022B29B5A8E3A78A3E41ADEE085E05214D808F0807364FD3E2365FC0E519 2 Contact by email: [email protected] Your key: 2AEA022B29B5A8E3A78A3E41ADEE085E05214D808F0807364FD3E2365FC0E519 Include your key in your letter Our guarantee: we provide free decyrption for 3 files up to 3 megabytes (not zip,db,backup)
Emails
URLs
-
http://weaxorpemwzoxg5cdvvfd77p3qczkxqii37ww4foo2n4jcft3mytbpyd.onion/lsaHqOhaJLOyrWSPvtJajdzqrftqzOlt/2AEA022B29B5A8E3A78A3E41ADEE085E05214D808F0807364FD3E2365FC0E519
Targets
-
- Target 2026-08-07_58d4294b32b94bbaee3d64c5b88dd371_cobalt-strike_coinminer_icedid_luca-stealer_njrat_stealc
- Size 668KB
- SHA256 4b03cd6348172b97cd8e0e2eba81316c4a6402b3a70e10b2c36bd29dd0e2638f
Score10/10-
Renames multiple (1930) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.