seven | 2026-08-08_c63ef2eee4491322e1cc9167f51e0e67_7ev3n_elex_hawkeye_mespinoza

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_c63ef2eee4491322e1cc9167f51e0e67_7ev3n_elex_hawkeye_mespinoza
Size 363KB
Sample260808-fehecabg76
SHA256 06e01cbb72981f610c92d8b6ed608b63d5c7f1583ef762a6cb57a72435a3a5a0
MD5 c63ef2eee4491322e1cc9167f51e0e67
SHA1 20990a5f00311e0c19151fd8881b04b3150ac0ae
SHA512 1655e1b930e385ba1d7162fb95aeda3f3686cfefbb22b4e019b0c55ae1315df663f57c3b025a1b09347082cfcbf6244af69f0e18d1bd16c05ed6873536229cc3
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371o7:/uTs1gBpQL5kmh0671o7
TLSH
T158840826B14198E6DD7268791A65BBFEAA2DB4704B940FF7F7C24AA404E03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ransomware seven

Malware Config

Signatures

Family: Seven, SevenCrypt, 7ev3n
Seven aka SevenCrypt or 7ev3n is a ransomware.
ransomware seven

Detects Seven ransomware 1 IoCs

resource	yara_rule
sample	family_seven

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_c63ef2eee4491322e1cc9167f51e0e67_7ev3n_elex_hawkeye_mespinoza

File Explorer

2026-08-08_c63ef2eee4491322e1cc9167f51e0e67_7ev3n_elex_hawkeye_mespinoza

.exe 363KB

2026-08-08_c63ef2eee4491322e1cc9167f51e0e67_7ev3n_elex_hawkeye_mespinoza

IMPHASH 266bed6766ee2a20cf7c2dd0d6245d96
SHA256 06e01cbb72981f610c92d8b6ed608b63d5c7f1583ef762a6cb57a72435a3a5a0
MD5 c63ef2eee4491322e1cc9167f51e0e67
SHA1 20990a5f00311e0c19151fd8881b04b3150ac0ae
SHA512 1655e1b930e385ba1d7162fb95aeda3f3686cfefbb22b4e019b0c55ae1315df663f57c3b025a1b09347082cfcbf6244af69f0e18d1bd16c05ed6873536229cc3
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371o7:/uTs1gBpQL5kmh0671o7
TLSH
T158840826B14198E6DD7268791A65BBFEAA2DB4704B940FF7F7C24AA404E03C11B74F13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects Seven ransomware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

158849

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\admin\Desktop\new version with NO UAC\Release\Win32Project9.pdb

kernel32

GetCurrentProcess CreateProcessW ExitThread WaitForSingleObject GetLastError ExitProcess IsDebuggerPresent GetVersionExW GetVolumeInformationW SetEndOfFile HeapSize WriteConsoleW ReadConsoleW GetProcAddress FindFirstFileExW FindClose GetCommandLineW GetCommandLineA GetProcessHeap SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage SetFilePointerEx GetConsoleMode GetConsoleCP GetModuleHandleW CreateProcessA GetStartupInfoA GetModuleFileNameW SetFileAttributesA CopyFileA GetFileAttributesA GetModuleFileNameA CloseHandle ReadFile GetFileSize CreateFileW GetFileAttributesW FindFirstFileW FindNextFileW SetFileAttributesW GetLocalTime CreateThread WinExec GetLogicalDrives SetStdHandle FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale Sleep GetFileAttributesExW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead WideCharToMultiByte MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo FreeLibrary LoadLibraryExW RaiseException RtlUnwind QueryPerformanceFrequency MoveFileExW GetModuleHandleExW GetStdHandle WriteFile GetACP HeapAlloc HeapReAlloc HeapFree GetFileType GetExitCodeProcess

user32

GetSystemMetrics LoadCursorW RegisterClassExW CreateWindowExW ShowWindow ScreenToClient GetCursorPos DrawTextA MessageBoxW DefWindowProcW PostQuitMessage DestroyWindow SetTimer KillTimer InvalidateRect EndPaint DrawTextW FillRect BeginPaint DispatchMessageW TranslateMessage GetMessageW GetWindowLongW SetWindowLongW

gdi32

LineTo MoveToEx CreatePen SetBkMode DeleteObject TextOutA TextOutW SetTextColor SetBkColor SelectObject CreateFontW CreateSolidBrush

advapi32

SystemFunction036 RegCloseKey RegQueryValueExW RegOpenKeyExW GetUserNameW

wininet

InternetOpenUrlW InternetReadFile InternetOpenW

netapi32

NetUserGetInfo

Name

.text

Size

269KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

840B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_c63ef2eee4491322e1cc9167f51e0e67_7ev3n_elex_hawkeye_mespinoza

kernel32

user32

gdi32

advapi32

wininet

netapi32

generic