Overview

overview

10

Static

static

10

2026-08-16...ry.exe

windows10-2004-x64

10

2026-08-16...ry.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-08-16_0c2a55d5914b59e0b0967db94918e089_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_wannacry
  • Size 5.1MB
  • Sample260816-ftbv4szgnb
  • SHA256 11425bd8f2b626f37377cc53ae4d9adb1eb4bea0a37e9d62500e8ea2986e0fef
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwarestealerthemidaupx

Malware Config

Extracted

Path

  • C:\HOW_TO_RECOVER.txt

Ransom Note
  • All Your Files Has Been Encrypted You Have to Pay to Get Your Files Back You cannot decrypt the files yourself. This will only corrupt the files The only way to decrypt is to purchase a unique private key from us Only we can give you this key and only we can recover your files 1-Go to C:\ProgramData\ or in Your Drives and send us key.orexin key file 2-To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! 3-Changing Windows without saving KEY.orexin file will cause permanent Data loss Do you want to restore your files? Write to email: [email protected] Or send me a message on Telegram. My ID: https://t.me/orexin2026 ID: id-9901079387 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss.
URLs

  • https://t.me/orexin2026

Extracted

Path

  • C:\HOW_TO_RECOVER.txt

Ransom Note
  • All Your Files Has Been Encrypted You Have to Pay to Get Your Files Back You cannot decrypt the files yourself. This will only corrupt the files The only way to decrypt is to purchase a unique private key from us Only we can give you this key and only we can recover your files 1-Go to C:\ProgramData\ or in Your Drives and send us key.orexin key file 2-To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! 3-Changing Windows without saving KEY.orexin file will cause permanent Data loss Do you want to restore your files? Write to email: [email protected] Or send me a message on Telegram. My ID: https://t.me/orexin2026 ID: id-6727099590 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss.
URLs

  • https://t.me/orexin2026

Targets

    • Target
      2026-08-16_0c2a55d5914b59e0b0967db94918e089_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_wannacry
    • Size 5.1MB
    • SHA256 11425bd8f2b626f37377cc53ae4d9adb1eb4bea0a37e9d62500e8ea2986e0fef
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    credential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwarestealer

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Renames multiple (7662) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Deletes System State backups

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Modifies Windows Firewall

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

Windows Command Shell

1
T1059.003

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Direct Volume Access

1
T1006

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Indicator Removal

3
T1070

File Deletion

3
T1070.004

Modify Registry

3
T1112

Credential Access

Credentials from Password Stores

1
T1555

Windows Credential Manager

1
T1555.004

Discovery

Peripheral Device Discovery

2
T1120

Query Registry

4
T1012

System Information Discovery

4
T1082

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

4
T1490

Tasks