Overview

overview

10

Static

static

3

IronChain.exe

windows11-21h2-x64

10

Resubmissions

22/09/2026, 18:45

260922-xeef5ada8710

31/05/2026, 06:32

260531-hawsaaaz8s10

Sharing

Copy URL Twitter E-mail

General

  • Target
    IronChain.exe
  • Size 11.8MB
  • Sample260922-xeef5ada87
  • SHA256 e95f39cae2c98b46f5f4d5e6587047273610ebde44755eae78d3f416200f8d72
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
bootkitdefense_evasiondiscoveryevasionexecutionexploitpersistenceprivilege_escalationpyinstallerransomwaretrojan

Malware Config

Extracted

Path

  • C:\Users\Admin\Desktop\PLEASEREADTHIS.txt

Ransom Note
  • YOUR FILES HAVE BEEN ENCRYPTED BY IRONCHAIN! All your documents, photos, videos and other important files have been encrypted with military-grade encryption. You cannot access them without our decryption tool. To recover your files, you must pay a ransom in Bitcoin. The price is $1000 USD worth of Bitcoin. The price doubles every 24 hours. You have 3 days to pay. Visit the following Tor site for instructions: http://ironchaindecrypt7xfzq5tclm9jzpwq72uofgy2znkdsxm54zbcu2yid.onion DO NOT modify the encrypted files. DO NOT try to use third-party recovery tools. Any attempt to tamper with the encryption may result in permanent data loss. Your unique ID: TWUX39NF8WLZYJRY Your IP address: 10.127.0.53 We are watching. Pay or lose your data forever.
URLs

  • http://ironchaindecrypt7xfzq5tclm9jzpwq72uofgy2znkdsxm54zbcu2yid.onion

Extracted

Path

  • C:\Users\Admin\Desktop\IronChain.hta

Ransom Note
  • IRONCHAIN RANSOMWARE 🔒 PC Username: Admin IP Address: 10.127.0.53 YOUR FILES ARE ENCRYPTED - DO NOT SHUT DOWN Pay before it hits 0 3d 0h 0m 0s Price doubles in 1d 0h 0m 0s Select Language ‼️ YOUR FILES ARE ENCRYPTED ‼️ All your personal files have been encrypted... IRONCHAIN v3.0 - Your data is our business var infectionTime = new Date(1790102760.984211 * 1000); var deadline = new Date(1790361960.984211 * 1000); var username = "Admin"; var ip = "10.127.0.53"; var randomId = "19ZX7G86WCTMAUP6"; var translations = { en: { title: "IRONCHAIN RANSOMWARE", pc_username: "PC Username: ", ip_address: "IP Address: ", pay_before: "Pay before it hits 0", price_doubles: "Price doubles in", select_language: "Select Language", message_title: "‼️ YOUR FILES ARE ENCRYPTED ‼️", message_content: "All your personal files have been encrypted by IRONCHAIN!\n\nTo recover your files, you must pay a ransom of $1000 in Bitcoin. The price doubles every 24 hours. You have 3 days from infection.\n\nVisit: http://ironchaindecrypt7xfzq5tclm9jzpwq72uofgy2znkdsxm54zbcu2yid.onion\n\nDo not modify encrypted files. Do not attempt recovery yourself. Any tampering will result in permanent data loss.\n\nYour unique ID: {random_id}\n\nWe are watching. Pay or lose everything." }, es: { title: "IRONCHAIN RANSOMWARE", pc_username: "Nombre de usuario: ", ip_address: "Dirección IP: ", pay_before: "Paga antes de que llegue a 0", price_doubles: "Precio se duplica en", select_language: "Seleccionar idioma", message_title: "‼️ TUS ARCHIVOS ESTÁN CIFRADOS ‼️", message_content: "Todos tus archivos personales han sido cifrados por IRONCHAIN!\n\nPara recuperar tus archivos, debes pagar un rescate de $1000 en Bitcoin. El precio se duplica cada 24 horas. Tienes 3 días desde la infección.\n\nVisita: http://ironchaindecrypt7xfzq5tclm9jzpwq72uofgy2znkdsxm54zbcu2yid.onion\n\nNo modifiques los archivos cifrados. No intentes recuperarlos por tu cuenta. Cualquier manipulación resultará en pérdida permanente de datos.\n\nTu ID único: {random_id}\n\nEstamos vigilando. Paga o pierde todo." }, fr: { title: "IRONCHAIN RANÇONGICIEL", pc_username: "Nom d'utilisateur: ", ip_address: "Adresse IP: ", pay_before: "Payez avant qu'il atteigne 0", price_doubles: "Le prix double dans", select_language: "Choisir la langue", message_title: "‼️ VOS FICHIERS SONT CHIFFRÉS ‼️", message_content: "Tous vos fichiers personnels ont été chiffrés par IRONCHAIN!\n\nPour récupérer vos fichiers, vous devez payer une rançon de 1000$ en Bitcoin. Le prix double toutes les 24 heures. Vous avez 3 jours depuis l'infection.\n\nVisitez: http://ironchaindecrypt7xfzq5tclm9jzpwq72uofgy2znkdsxm54zbcu2yid.onion\n\nNe modifiez pas les fichiers chiffrés. N'essayez pas de récupérer vous-même. Toute altération entraînera une perte permanente de données.\n\nVotre ID unique: {random_id}\n\nNous surveillons. Payez ou perdez tout." }, de: { title: "IRONCHAIN RANSOMWARE", pc_username: "Benutzername: ", ip_address: "IP-Adresse: ", pay_before: "Bezahlen bevor es 0 erreicht", price_doubles: "Preis verdoppelt sich in", select_language: "Sprache auswählen", message_title: "‼️ IHRE DATEIEN WURDEN VERSCHLÜSSELT ‼️", message_content: "Alle Ihre persönlichen Dateien wurden von IRONCHAIN verschlüsselt!\n\nUm Ihre Dateien wiederherzustellen, müssen Sie ein Lösegeld von 1000$ in Bitcoin zahlen. Der Preis verdoppelt sich alle 24 Stunden. Sie haben 3 Tage ab der Infektion.\n\nBesuchen Sie: http://ironchaindecrypt7xfzq5tclm9jzpwq72uofgy2znkdsxm54zbcu2yid.onion\n\nVerändern Sie nicht die verschlüsselten Dateien. Versuchen Sie keine eigenständige Wiederherstellung. Jegliche Manipulation führt zu dauerhaftem Datenverlust.\n\nIhre eindeutige ID: {random_id}\n\nWir beobachten. Zahlen Sie oder verlieren Sie alles." } }; var currentLang = 'en'; function updateTimers() { var now = new Date(); var timeLeft = deadline - now; var days = Math.floor(timeLeft / (1000 * 60 * 60 * 24)); var hours = Math.floor((timeLeft % (1000 * 60 * 60 * 24)) / (1000 * 60 * 60)); var minutes = Math.floor((timeLeft % (1000 * 60 * 60)) / (1000 * 60)); var seconds = Math.floor((timeLeft % (1000 * 60)) / 1000); document.getElementById('countdown').innerHTML = days + "d " + hours + "h " + minutes + "m " + seconds + "s"; var nextDouble = new Date(infectionTime.getTime() + (Math.floor((now - infectionTime) / (24*60*60*1000)) + 1) * 24*60*60*1000); var doubleLeft = nextDouble - now; if (doubleLeft < 0) doubleLeft = 0; var dDays = Math.floor(doubleLeft / (1000 * 60 * 60 * 24)); var dHours = Math.floor((doubleLeft % (1000 * 60 * 60 * 24)) / (1000 * 60 * 60)); var dMinutes = Math.floor((doubleLeft % (1000 * 60 * 60)) / (1000 * 60)); var dSeconds = Math.floor((doubleLeft % (1000 * 60)) / 1000); document.getElementById('double-timer').innerHTML = dDays + "d " + dHours + "h " + dMinutes + "m " + dSeconds + "s"; } function changeLanguage() { var select = document.getElementById('langSelect'); currentLang = select.value; var t = translations[currentLang]; document.getElementById('title-bar').innerHTML = t.title; document.getElementById('username-label').innerHTML = t.pc_username + username; document.getElementById('ip-label').innerHTML = t.ip_address + ip; document.getElementById('pay-before-label').innerHTML = t.pay_before; document.getElementById('price-doubles-label').innerHTML = t.price_doubles; document.getElementById('msg-title').innerHTML = t.message_title; var msg = t.message_content.replace('{random_id}', randomId); document.getElementById('msg-content').innerHTML = msg.replace(/\n/g, '<br>'); } window.onload = function() { changeLanguage(); setInterval(updateTimers, 1000); };
URLs

  • http://ironchaindecrypt7xfzq5tclm9jzpwq72uofgy2znkdsxm54zbcu2yid.onion\n\nDo

  • http://ironchaindecrypt7xfzq5tclm9jzpwq72uofgy2znkdsxm54zbcu2yid.onion\n\nNo

  • http://ironchaindecrypt7xfzq5tclm9jzpwq72uofgy2znkdsxm54zbcu2yid.onion\n\nNe

  • http://ironchaindecrypt7xfzq5tclm9jzpwq72uofgy2znkdsxm54zbcu2yid.onion\n\nVerändern

Targets

    • Target
      IronChain.exe
    • Size 11.8MB
    • SHA256 e95f39cae2c98b46f5f4d5e6587047273610ebde44755eae78d3f416200f8d72
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    bootkitdefense_evasiondiscoveryevasionexecutionexploitpersistenceprivilege_escalationransomwaretrojan
    behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

PowerShell

1
T1059.001

Windows Command Shell

1
T1059.003

System Services

2
T1569

Service Execution

2
T1569.002

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

4
T1543

Windows Service

4
T1543.003

Event Triggered Execution

2
T1546

Image File Execution Options Injection

1
T1546.012

Netsh Helper DLL

1
T1546.007

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Create or Modify System Process

4
T1543

Windows Service

4
T1543.003

Event Triggered Execution

2
T1546

Image File Execution Options Injection

1
T1546.012

Netsh Helper DLL

1
T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

File and Directory Permissions Modification

1
T1222

Impair Defenses

5
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

2
T1562.001

Safe Mode Boot

1
T1562.009

Modify Registry

5
T1112

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Remote System Discovery

1
T1018

System Information Discovery

2
T1082

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

2
T1489

Tasks