General
- Target 5b358f7cb6c2.zip
- Size 3.1MB
- Sample260823-bpec8aha26
- SHA256 f680c695c92aff70ca4736d5a05ce5df5655adcec306454838f9df32da9a3b5c
- MD5 5fd970985c0973691ea737dba2ef3df9
- SHA1 04a5b67f3fc2c73e52dc007b83710a92be83cd1f
- SHA512 01ca5db85d345cc81cc6ca5f19021f7f11bda9a4e9bc99f89123c439e271ab41c9f853a201b1a9058c617903b866e013de954a6b40e5d7f6b316918de2cf5f75
- SSDEEP 98304:zGtSs7vm0+L5knU/VbcUlK7NFp8N6MBHt:zU7O0+L5n/VCJ7XmHt
- TLSH T116E533EEF6BC89546F19C090F4FC8925800C270A67A2BFE1D7683DC7584F524D6AAC5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
5b358f7cb6c2f16badbb476f7fa7515d4c142a1c1c47e22ab058155aa3120ba1.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
5b358f7cb6c2f16badbb476f7fa7515d4c142a1c1c47e22ab058155aa3120ba1.exe
Resource
win11ltsc2024-20260710-en
Malware Config
Extracted
-
agenda
-
Username
-
Password
Chirpy&Loopy
-
Username
-
Password
Netbsd00!
-
Username
-
Password
840Lenola
-
Username
-
Password
sEM+!F7S2Qhew"n^
-
Username
-
Password
Pizza&Beer
-
Username
-
Password
Ioynoy#23
-
company_id
6As9otV_qU
-
note
-- Qilin Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from your system/network. Our group cooperates with the mass media. If you refuse to communicate with us and we do not come to an agreement, your data will be reviewed and published on our blog and on the media page (https://wikileaks2.site/) Blog links: http://kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials Please note that communication with us is only possible via the website in the Tor browser, which is specified in this note. All other means of communication are not real and may be created by third parties, if such were not provided in this note or on the website specified in this note. -- Credentials Extension: 6As9otV_qU Domain: cneqp3byltyggabjdnqlvayonh24mipwkcxtt7vqnmg3qncvl2d7bvyd.onion login: mpP6QFwfkjvGv_2tGKmYDPNVHZFyWbUZ password:
Targets
-
- Target 5b358f7cb6c2f16badbb476f7fa7515d4c142a1c1c47e22ab058155aa3120ba1.exe
- Size 5.0MB
- SHA256 5b358f7cb6c2f16badbb476f7fa7515d4c142a1c1c47e22ab058155aa3120ba1
- MD5 5d9b5e2e48c3d32993a28526d99daa0e
- SHA1 8bcaa69025e4f350ad585ea9ee2ab4d74feb1b29
- SHA512 5c5b6e696d26bf65b661bb0ea20403cd383b1e6e226811585c4a0ea3f0d40569190a21dd661f2d60453461b5cadf9d1fd0756f8af55e3800ec71e563197066c0
- SSDEEP 98304:7VMm3G60241caEdee3eW9fhSxGzHWEMnaDGcoVobudSXJtbEbGhHNMlAtfkrNCu0:7R0OTpk5Qd7lySfv88UutSE
- TLSH T13236E0EE08E32CB9E21D84F33575BD5863E6CAD8406D10FD5AC41F3620D7A6B24B29D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Family: Agenda Ransomware
A ransomware with multiple variants written in Golang and Rust first seen in August 2022.