Overview

overview

10

Static

static

3

2026-08-08...lc.exe

windows10-2004-x64

10

2026-08-08...lc.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-08-08_b57663d4282dd34892b668950cdc1be6_cobalt-strike_icedid_njrat_satacom_stealc
  • Size 365KB
  • Sample260808-x3m36sfc25
  • SHA256 94e8627d2a07a705a2b929bbc60cf9af7a7dd64ddc8212e3f5acb83ac124cc2b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Extracted

Path

  • C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt

Ransom Note
  • *** YOUR FILES HAVE BEEN ENCRYPTED BY C4N0F *** All your documents, pictures, videos and databases have been locked. Your device has been seized. Do not try to recover the files yourself. Do not turn off your computer you dumb shit. ID : 2C170C3C HOSTNAME : XWFPSFRW IP : UNAVAILABLE YOU HAVE 24 HOURS. WHEN THE COUNTDOWN REACHES ZERO ALL YOUR DATA WILL BE PERMANENTLY DELETED. 3 WRONG PASSWORDS = IMMEDIATE PERMANENT DELETION. To restore your files, enter the decryption key in the window on your screen. The key was on my server. good luck! discord.gg/B4ds5xKfvV guns.lol/C4N0F

Extracted

Path

  • C:\Users\Admin\Desktop\DECRYPT_INSTRUCTIONS.txt

Ransom Note
  • *** YOUR FILES HAVE BEEN ENCRYPTED BY C4N0F *** All your documents, pictures, videos and databases have been locked. Your device has been seized. Do not try to recover the files yourself. Do not turn off your computer you dumb shit. ID : 2C170C3C HOSTNAME : WLQWINKU IP : UNAVAILABLE YOU HAVE 24 HOURS. WHEN THE COUNTDOWN REACHES ZERO ALL YOUR DATA WILL BE PERMANENTLY DELETED. 3 WRONG PASSWORDS = IMMEDIATE PERMANENT DELETION. To restore your files, enter the decryption key in the window on your screen. The key was on my server. good luck! discord.gg/B4ds5xKfvV guns.lol/C4N0F

Targets

    • Target
      2026-08-08_b57663d4282dd34892b668950cdc1be6_cobalt-strike_icedid_njrat_satacom_stealc
    • Size 365KB
    • SHA256 94e8627d2a07a705a2b929bbc60cf9af7a7dd64ddc8212e3f5acb83ac124cc2b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

    • Disables Task Manager via registry modification

      defense_evasion

    • Creates a file in the Startup directory

      A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

      persistenceprivilege_escalation

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks