Overview

overview

10

Static

static

10

2026-08-15...it.exe

windows10-2004-x64

10

2026-08-15...it.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-08-15_20752e5d24016f92fc159881427b4e2b_coinminer_darkside_elex_lockbit
  • Size 150KB
  • Sample260815-njvjgavemc
  • SHA256 b49f3d36e3f5d54635debcdf2d42cf40725deaede03a33b6aea55947cbc584d5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
lockbitdefense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\pTJb2TvTp.README.txt

Ransom Note
  • ************************************************** WELCOME TO BimaX RANSOMWARE ************************************************** Dear Administrator, This is an official notification that your organization's network infrastructure, including all servers, endpoints, and virtualized environments, has been successfully breached and compromised. All critical assets—including production databases, document repositories, backup archives, and virtual machine images—have been encrypted using a military-grade, asymmetric cryptographic algorithm. Additionally, a substantial volume of sensitive corporate data has been exfiltrated, encompassing client personally identifiable information (PII), proprietary financial statements, trade secrets, and internal correspondence. Please be advised that all on-premises and cloud-based backup systems have been permanently deleted, overwritten, or rendered wholly inaccessible. ************************************************** WHAT ARE YOUR GUARANTEES? ************************************************** We operate as a disciplined, results-oriented organization. Our reputation for reliability and precision is the cornerstone of our business model. We adhere strictly to our commitments: if we fail to provide a functional decryption solution, we receive no compensation. This principle underpins our operational integrity. Our decryption tools have undergone extensive testing and are engineered to restore 100103774134f your encrypted data with efficiency and accuracy. Upon confirmation of payment, you will receive the complete decryption software suite, alongside verifiable proof that all exfiltrated data has been securely and permanently purged from our systems. We prioritize speed and precision because we understand that operational downtime directly impacts your business continuity. To acquire the decryption software and initiate the secure deletion of your stolen data, please establish contact through the following encrypted and anonymous channels: TOX: Download: https://tox.chat/download.html Tox ID: FB191E7FE6876915504ECB45980C680FD89CA257EAD64686787BB3E9C187EB418606E25A526F Session Messenger: Download: https://getsession.org/download Session ID: 05e63ad9fbd88d65e99c672f3767f4e9d058ab3aa5b2a9760b2210d700380b8759 COOPERATE TO PREVENT DATA LEAK (239 HOURS LEFT) Check our blog: http://64nyijctmvda672ygmurdntxom7qnssaut2wb4izamafuabovaylusqd.onion/ Download Tor browser: https://www.torproject.org/download/ Your Unique Decryption Identifier: DECRYPT ID: <<< {id} >>> ************************************************** CRITICAL WARNING ************************************************** **DO NOT** attempt to recover, decrypt, or modify any encrypted files using third-party tools, system restores, or manual interventions. Such actions may cause irreversible damage to the encrypted data, rendering it unrecoverable even with our private key. **DO NOT** contact law enforcement, cybersecurity insurers, or external incident response firms prior to engaging with us. Any such action will be interpreted as a breach of negotiation terms and will result in: - Immediate and permanent destruction of your decryption keys. - Public disclosure of all exfiltrated sensitive data via our channels. *************************************************************************************
URLs

  • https://tox.chat/download.html

  • https://getsession.org/download

  • http://64nyijctmvda672ygmurdntxom7qnssaut2wb4izamafuabovaylusqd.onion/

Extracted

Path

  • C:\pTJb2TvTp.README.txt

Ransom Note
  • ************************************************** WELCOME TO BimaX RANSOMWARE ************************************************** Dear Administrator, This is an official notification that your organization's network infrastructure, including all servers, endpoints, and virtualized environments, has been successfully breached and compromised. All critical assets—including production databases, document repositories, backup archives, and virtual machine images—have been encrypted using a military-grade, asymmetric cryptographic algorithm. Additionally, a substantial volume of sensitive corporate data has been exfiltrated, encompassing client personally identifiable information (PII), proprietary financial statements, trade secrets, and internal correspondence. Please be advised that all on-premises and cloud-based backup systems have been permanently deleted, overwritten, or rendered wholly inaccessible. ************************************************** WHAT ARE YOUR GUARANTEES? ************************************************** We operate as a disciplined, results-oriented organization. Our reputation for reliability and precision is the cornerstone of our business model. We adhere strictly to our commitments: if we fail to provide a functional decryption solution, we receive no compensation. This principle underpins our operational integrity. Our decryption tools have undergone extensive testing and are engineered to restore 10053773704f your encrypted data with efficiency and accuracy. Upon confirmation of payment, you will receive the complete decryption software suite, alongside verifiable proof that all exfiltrated data has been securely and permanently purged from our systems. We prioritize speed and precision because we understand that operational downtime directly impacts your business continuity. To acquire the decryption software and initiate the secure deletion of your stolen data, please establish contact through the following encrypted and anonymous channels: TOX: Download: https://tox.chat/download.html Tox ID: FB191E7FE6876915504ECB45980C680FD89CA257EAD64686787BB3E9C187EB418606E25A526F Session Messenger: Download: https://getsession.org/download Session ID: 05e63ad9fbd88d65e99c672f3767f4e9d058ab3aa5b2a9760b2210d700380b8759 COOPERATE TO PREVENT DATA LEAK (239 HOURS LEFT) Check our blog: http://64nyijctmvda672ygmurdntxom7qnssaut2wb4izamafuabovaylusqd.onion/ Download Tor browser: https://www.torproject.org/download/ Your Unique Decryption Identifier: DECRYPT ID: <<< {id} >>> ************************************************** CRITICAL WARNING ************************************************** **DO NOT** attempt to recover, decrypt, or modify any encrypted files using third-party tools, system restores, or manual interventions. Such actions may cause irreversible damage to the encrypted data, rendering it unrecoverable even with our private key. **DO NOT** contact law enforcement, cybersecurity insurers, or external incident response firms prior to engaging with us. Any such action will be interpreted as a breach of negotiation terms and will result in: - Immediate and permanent destruction of your decryption keys. - Public disclosure of all exfiltrated sensitive data via our channels. *************************************************************************************
URLs

  • https://tox.chat/download.html

  • https://getsession.org/download

  • http://64nyijctmvda672ygmurdntxom7qnssaut2wb4izamafuabovaylusqd.onion/

Targets

    • Target
      2026-08-15_20752e5d24016f92fc159881427b4e2b_coinminer_darkside_elex_lockbit
    • Size 150KB
    • SHA256 b49f3d36e3f5d54635debcdf2d42cf40725deaede03a33b6aea55947cbc584d5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryransomwarespywarestealer

    • Renames multiple (1023) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks