General
- Target 431194da56ac840593ffc09ed03fcca3c328100b0e0ba43b19674f0a416874e9.zip
- Size 1.9MB
- Sample260913-c7wwnaeb24
- SHA256 45fe51d367ea93a6a5d751e2f33fc4fe14076823795a2d8c9c4946b4f7bd15ee
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Desktop\LamiaLoader.txt
Ransom Note
- Hello, looks like you got a little snake problem. Pay us 500€ in XMR Monero and the snakes go away, for ever. Dont pay and all files, every single byte becomes unusable, the entire system will be permanently corrupted and all data will be sold on our auction platform. Be nice and pay us, dont talk to anyone and keep quiet, we will handle the rest :) Our XMR Wallet: 48pgNAez4CLUB4y4iAqbw742BP7Tuv8EM2xdBGsBxJDoQdk5bzVcA7NQrk5w4i3pUETrr5gr7xZ5f5EqoSDj98BYBhPkvU6 You have 72 hours to pay, after we will permanently delete the decryption key. To get your decryption key you need to contact us via Session: 05a91f81ed92ad37cde73401230a5460d4b3c778277f7d33f27804b8f251e27b3a You can download Session at: https://getsession.org/ Please follow the instructions on the page to install and setup Session Include your HWID and proof of payment. To get your HWID you can use our HWID extractor: https://workupload.com/file/4zC8SLR9qbp To get our file decryptor you can follow this link: https://workupload.com/file/SwhwRL3KcE6
URLs
-
https://getsession.org/
-
https://workupload.com/file/4zC8SLR9qbp
-
https://workupload.com/file/SwhwRL3KcE6
Targets
-
- Target 431194da56ac840593ffc09ed03fcca3c328100b0e0ba43b19674f0a416874e9.exe
- Size 4.7MB
- SHA256 431194da56ac840593ffc09ed03fcca3c328100b0e0ba43b19674f0a416874e9
Score10/10-
Renames multiple (3223) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.