e28f9c05642ddc269815437882577f489259518306f482bae2e969d25b5619f1

General

Target
2026-08-23_979f672985f14ae95942fcffe938da4b_amadey_elex_smoke-loader_stealc_tofsee
Size 179KB
Sample260825-27dgraw1h1
SHA256 e28f9c05642ddc269815437882577f489259518306f482bae2e969d25b5619f1
MD5 979f672985f14ae95942fcffe938da4b
SHA1 7a026c7d793fe3928acd0820baf1f0832c9a16fa
SHA512 d9bc03a67f84315cbd323d1bdd9f153cabb87e6a616f27ba0a37ba9ba5430c1ab7788e27ed12c0baee2cf8fad331af70d3e5e0cbccc18ebcb6dc3e78b3b4d667
SSDEEP 3072:yHyaJ9h/MybRlzol5ee9dqdijDju4PW0odfggmVAi6OXLjXUvqFMIfIJi:2xbvzGe0Yi80odogmVAi6OPEviP
TLSH
T1DD049D127241C073D0E7027A5BB99BF01CBC1C3AA32850CFA3787AAA6D796D1527D797
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\Common Files\DESIGNER\-!RecOveR!-ktwlr++.Txt

Ransom Note

,%:+'7*("7,6 6* $+5)7 #3(*4:2& ------- ,%:+'7*("7,6 6* $+5)7 #3(*4:2& NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA-4096. Use the link down below to find additional information on the encryption keys using RSA-4096 https://en.wikipedia.org/wiki/RSA_(cryptosystem) ,%:+'7*("7,6 6* $+5)7 #3(*4:2& ------- ,%:+'7*("7,6 6* $+5)7 #3(*4:2& What exactly that means? It means that on a structural level your files have been transformed . You won't be able to use , read , see or work with them anymore . In other words they are useless , however , there is a possibility to restore them with our help . What exactly happened to your files ??? !!! Two personal RSA-4096 keys were generated for your PC/Laptop; one key is public, another key is private. !!! All your data and files were encrypted by the means of the public key , which you received over the web . !!! In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. ,%:+'7*("7,6 6* $+5)7 #3(*4:2& ----- ,%:+'7*("7,6 6* $+5)7 #3(*4:2& !!! What should you do next ??? In case you have valuable files , we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions , please access your personal homepage by choosing one of the few addresses down below : http://74bfc.flubspiel.com/97318738BFD229E http://ibf4d.ukegaub.at/97318738BFD229E http://k3cxd.pileanoted.com/97318738BFD229E If you can't access your personal homepage or the addresses are not working, complete the following steps: *** Download and Install TOR Browser - http://www.torproject.org/projects/torbrowser.html.en *** Run TOR Browser Insert link in the address bar: xzjvzkgjxebzreap.onion/97318738BFD229E ,%:+'7*("7,6 6* $+5)7 #3(*4:2& ----IMPORTANT*****************INFORMATION---------,%:+'7*("7,6 6* $+5)7 #3(*4:2& Your personal homepages http://74bfc.flubspiel.com/97318738BFD229E http://ibf4d.ukegaub.at/97318738BFD229E http://k3cxd.pileanoted.com/97318738BFD229E Your personal homepage Tor-Browser xzjvzkgjxebzreap.onion/97318738BFD229E Your personal ID 97318738BFD229E ,%:+'7*("7,6 6* $+5)7 #3(*4:2& ,%:+'7*("7,6 6* $+5)7 #3(*4:2& ,%:+'7*("7,6 6* $+5)7 #3(*4:2&

URLs

http://74bfc.flubspiel.com/97318738BFD229E
http://ibf4d.ukegaub.at/97318738BFD229E
http://k3cxd.pileanoted.com/97318738BFD229E
http://xzjvzkgjxebzreap.onion/97318738BFD229E

Extracted

Path

C:\Program Files\Common Files\DESIGNER\-!RecOveR!-ehswp++.Txt

Ransom Note

729/98)7,'6'>-)-4("351+?$>2)<"? ------- 729/98)7,'6'>-)-4("351+?$>2)<"? NOT YOUR LANGUAGE? USE https://translate.google.com What's the matter with your files? Your data was secured using a strong encryption with RSA-4096. Use the link down below to find additional information on the encryption keys using RSA-4096 https://en.wikipedia.org/wiki/RSA_(cryptosystem) 729/98)7,'6'>-)-4("351+?$>2)<"? ------- 729/98)7,'6'>-)-4("351+?$>2)<"? What exactly that means? It means that on a structural level your files have been transformed . You won't be able to use , read , see or work with them anymore . In other words they are useless , however , there is a possibility to restore them with our help . What exactly happened to your files ??? !!! Two personal RSA-4096 keys were generated for your PC/Laptop; one key is public, another key is private. !!! All your data and files were encrypted by the means of the public key , which you received over the web . !!! In order to decrypt your data and gain access to your computer you need a private key and a decryption software, which can be found on one of our secret servers. 729/98)7,'6'>-)-4("351+?$>2)<"? ----- 729/98)7,'6'>-)-4("351+?$>2)<"? !!! What should you do next ??? In case you have valuable files , we advise you to act fast as there is no other option rather than paying in order to get back your data. In order to obtain specific instructions , please access your personal homepage by choosing one of the few addresses down below : http://74bfc.flubspiel.com/20465C53BB9BC173 http://ibf4d.ukegaub.at/20465C53BB9BC173 http://k3cxd.pileanoted.com/20465C53BB9BC173 If you can't access your personal homepage or the addresses are not working, complete the following steps: *** Download and Install TOR Browser - http://www.torproject.org/projects/torbrowser.html.en *** Run TOR Browser Insert link in the address bar: xzjvzkgjxebzreap.onion/20465C53BB9BC173 729/98)7,'6'>-)-4("351+?$>2)<"?----IMPORTANT*****************INFORMATION---------729/98)7,'6'>-)-4("351+?$>2)<"? Your personal homepages http://74bfc.flubspiel.com/20465C53BB9BC173 http://ibf4d.ukegaub.at/20465C53BB9BC173 http://k3cxd.pileanoted.com/20465C53BB9BC173 Your personal homepage Tor-Browser xzjvzkgjxebzreap.onion/20465C53BB9BC173 Your personal ID 20465C53BB9BC173 729/98)7,'6'>-)-4("351+?$>2)<"? 729/98)7,'6'>-)-4("351+?$>2)<"? 729/98)7,'6'>-)-4("351+?$>2)<"?

URLs

http://74bfc.flubspiel.com/20465C53BB9BC173
http://ibf4d.ukegaub.at/20465C53BB9BC173
http://k3cxd.pileanoted.com/20465C53BB9BC173
http://xzjvzkgjxebzreap.onion/20465C53BB9BC173

Targets

- Target
  2026-08-23_979f672985f14ae95942fcffe938da4b_amadey_elex_smoke-loader_stealc_tofsee
- Size 179KB
- SHA256 e28f9c05642ddc269815437882577f489259518306f482bae2e969d25b5619f1
- MD5 979f672985f14ae95942fcffe938da4b
- SHA1 7a026c7d793fe3928acd0820baf1f0832c9a16fa
- SHA512 d9bc03a67f84315cbd323d1bdd9f153cabb87e6a616f27ba0a37ba9ba5430c1ab7788e27ed12c0baee2cf8fad331af70d3e5e0cbccc18ebcb6dc3e78b3b4d667
- SSDEEP 3072:yHyaJ9h/MybRlzol5ee9dqdijDju4PW0odfggmVAi6OXLjXUvqFMIfIJi:2xbvzGe0Yi80odogmVAi6OPEviP
- TLSH
  T1DD049D127241C073D0E7027A5BB99BF01CBC1C3AA32850CFA3787AAA6D796D1527D797
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution impact persistence privilege_escalation ransomware spyware stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
behavioral1 behavioral2