Overview

overview

10

Static

static

10

2026-09-30...om.exe

windows10-2004-x64

10

2026-09-30...om.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-09-30_fb23b05580fd55cb97044449fe3f07cf_akira_cobalt-strike_glassworm_rusty-stealer_satacom
  • Size 1.7MB
  • Sample261001-bzhtdstglf
  • SHA256 fadf86583145544f49d12923ec28bddfdc97633c03d7a466493f1b219137efc7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
rexdefense_evasiondiscoveryexecutionimpactransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Program Files\7-Zip\Lang\RANSOM_NOTE.html

Ransom Note
  • <h1 class="ql-align-center">Your personal ID:</h1><p class="ql-align-center"><span style="color: rgb(255, 255, 255);"> Key ID: 5C09 14F0 5888 62F5 16B9 8963 5024 B42C 335E AFDE 88B9 E535 90F1 9CE7 82D1 50B2 181D B380 E796 96E4 A817 4589 B8B8 9D1C 3CDE 439E C11F 8F64 9E98 78C2 476D 36F2 0855 26B2 FD3B 381A 6AA8 DDD2 B338 E838 1CFD E7B8 2371 5509 CD9E 9AA3 B210 A90A A256 D63B 1B29 0B9D 9B65 23D9 5C2C CD64 B5FD AC94 A70D F584 8986 37B2 AF05 DD99 A97F CC0E DC5D 756B 9B0A 5AD2 5C02 463F E8FD DE4C 7B3D 973E D7E2 AF46 563A DE98 873F 11D8 B836 42EA 3C80 CCCA B2E4 6CEC E50E C5C5 BDF5 A63B C5AD 21AB 7661 E3C6 CBEC D044 BDF5 68 </span></p><h2 class="ql-align-center">YOUR COMPANY NETWORK HAS BEEN <span style="background-color: rgb(253, 84, 102);">PENETRATED</span></h2><h3><br></h3><h3 class="ql-align-center"><strong> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. </strong></h3><h3 class="ql-align-center">We gathered highly confidential/personal data. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you decide to not pay, we will release your data to public or re-seller. So you can expect your data to be publicly available in the near future.. We only seek money and our goal is not to damage your reputation or prevent your business from running. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back.</h3><p><br></p><h1 class="ql-align-center">Contact us for price and get decryption software.</h1><h3 class="ql-align-center"><strong>Email:</strong></h3><h2 class="ql-align-center"><a href="mailto:[email protected]" rel="noopener noreferrer" target="_blank">[email protected]</a></h2><h2 class="ql-align-center"><a href="mailto:[email protected]" rel="noopener noreferrer" target="_blank">[email protected]</a></h2><h3 class="ql-align-center">(To contact us, please create a Proton or Hotmail account. Don't use Gmail, as your messages will end up in spam.)</h3><h3 class="ql-align-center"><br></h3><h2 class="ql-align-center"><span style="color: violet;">Tor chat address: 723pt5dc2plfexrfvudhdhzvesgesqbcl4yivijjubptnogukxxv3hqd.onion</span></h2><h3><br></h3><h1 class="ql-align-center"><strong style="color: orange;">ATTENTION! </strong></h1><h2 class="ql-align-center"><strong style="color: orange;">THIS INFORMATION IS INTENDED FOR THOSE WHO WANT TO SEEK HELP FROM UNKNOWN OR UNVERIFIED SERVICES. NO ONE ELSE CAN HELP YOU. ONLY WE, WHOSE CONTACT INFORMATION IS PROVIDED ABOVE, CAN SEND YOU A DECRYPTOR AND DECRYPTOR YOUR FILES.</strong></h2><h2 class="ql-align-center"><br></h2><h2 class="ql-align-center"><strong style="color: orange;">THERE ARE NO PROGRAMS OR PEOPLE ON THE INTERNET READY TO HELP YOU. THERE ARE NO CHEAP, WORKING DECRYPTORS. IF YOU ASK FOR HELP OTHER THAN THE CONTACT INFORMATION PROVIDED IN THIS MESSAGE, YOU WILL PERMANENTLY LOSE YOUR MONEY AND FILES. BE CAREFUL AND DO NOT ATTEMPT TO RECOVER YOUR SYSTEM ANYWHERE ELSE.</strong></h2><h2 class="ql-align-center"><br></h2><h2 class="ql-align-center"><strong style="color: orange;">IF YOU INITIALLY CONTACTED US USING THE INFORMATION PROVIDED IN THIS EMAIL, RECEIVED A PRICE YOU WERE NOT SATISFIED WITH, AND FOUND A CHEAPER OPTION ELSEWHERE, THINK CAREFULLY BEFORE PAYING - YOU ARE DEFINITELY BEING SCAMMED!!!</strong></h2><h3><br></h3><h2 class="ql-align-center"><strong style="color: red;">IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER. </strong></h2>
Emails
URLs

  • http://723pt5dc2plfexrfvudhdhzvesgesqbcl4yivijjubptnogukxxv3hqd.onion</span></h2><h3><br></h3><h1

Extracted

Path

  • C:\Program Files\Common Files\RANSOM_NOTE.html

Ransom Note
  • <h1 class="ql-align-center">Your personal ID:</h1><p class="ql-align-center"><span style="color: rgb(255, 255, 255);"> Key ID: 40B8 E583 2E0D 3350 9FA4 75EE 4599 4A69 304A 7E6B B54E 9C28 EC60 45E3 4280 8AD8 B9C8 B131 6FF5 73AD 666B 51B2 4554 D725 12EC 6D72 FE4E 3ADC B463 4E8A C00A 0B75 EA9F AC3F 1634 2F43 70F6 CC5B 0F6B 19E2 B223 A61B 8A2F AFC7 C34E 6FEE AFA2 CB74 6226 6E08 242F F1F3 4A2B 100E 00E6 85FF 554D 439F 364A 33BF C6E8 8986 36E7 BDDC 4465 6E12 BDF0 99D4 5E0D DCFC 69EF 6A4F 7845 007F 39E6 B550 3419 6DD5 5679 947F 469B 1BDD EAB2 8BA3 6F16 A106 8C26 C726 1447 54C6 1FB7 AC2A 1BB0 D8D8 8386 0AD6 4036 FCB0 B9CB FA </span></p><h2 class="ql-align-center">YOUR COMPANY NETWORK HAS BEEN <span style="background-color: rgb(253, 84, 102);">PENETRATED</span></h2><h3><br></h3><h3 class="ql-align-center"><strong> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE WILL PERMANENTLY CORRUPT IT. DO NOT MODIFY ENCRYPTED FILES. DO NOT RENAME ENCRYPTED FILES. </strong></h3><h3 class="ql-align-center">We gathered highly confidential/personal data. These data are currently stored on a private server. This server will be immediately destroyed after your payment. If you decide to not pay, we will release your data to public or re-seller. So you can expect your data to be publicly available in the near future.. We only seek money and our goal is not to damage your reputation or prevent your business from running. You will can send us 2-3 non-important files and we will decrypt it for free to prove we are able to give your files back.</h3><p><br></p><h1 class="ql-align-center">Contact us for price and get decryption software.</h1><h3 class="ql-align-center"><strong>Email:</strong></h3><h2 class="ql-align-center"><a href="mailto:[email protected]" rel="noopener noreferrer" target="_blank">[email protected]</a></h2><h2 class="ql-align-center"><a href="mailto:[email protected]" rel="noopener noreferrer" target="_blank">[email protected]</a></h2><h3 class="ql-align-center">(To contact us, please create a Proton or Hotmail account. Don't use Gmail, as your messages will end up in spam.)</h3><h3 class="ql-align-center"><br></h3><h2 class="ql-align-center"><span style="color: violet;">Tor chat address: 723pt5dc2plfexrfvudhdhzvesgesqbcl4yivijjubptnogukxxv3hqd.onion</span></h2><h3><br></h3><h1 class="ql-align-center"><strong style="color: orange;">ATTENTION! </strong></h1><h2 class="ql-align-center"><strong style="color: orange;">THIS INFORMATION IS INTENDED FOR THOSE WHO WANT TO SEEK HELP FROM UNKNOWN OR UNVERIFIED SERVICES. NO ONE ELSE CAN HELP YOU. ONLY WE, WHOSE CONTACT INFORMATION IS PROVIDED ABOVE, CAN SEND YOU A DECRYPTOR AND DECRYPTOR YOUR FILES.</strong></h2><h2 class="ql-align-center"><br></h2><h2 class="ql-align-center"><strong style="color: orange;">THERE ARE NO PROGRAMS OR PEOPLE ON THE INTERNET READY TO HELP YOU. THERE ARE NO CHEAP, WORKING DECRYPTORS. IF YOU ASK FOR HELP OTHER THAN THE CONTACT INFORMATION PROVIDED IN THIS MESSAGE, YOU WILL PERMANENTLY LOSE YOUR MONEY AND FILES. BE CAREFUL AND DO NOT ATTEMPT TO RECOVER YOUR SYSTEM ANYWHERE ELSE.</strong></h2><h2 class="ql-align-center"><br></h2><h2 class="ql-align-center"><strong style="color: orange;">IF YOU INITIALLY CONTACTED US USING THE INFORMATION PROVIDED IN THIS EMAIL, RECEIVED A PRICE YOU WERE NOT SATISFIED WITH, AND FOUND A CHEAPER OPTION ELSEWHERE, THINK CAREFULLY BEFORE PAYING - YOU ARE DEFINITELY BEING SCAMMED!!!</strong></h2><h3><br></h3><h2 class="ql-align-center"><strong style="color: red;">IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER. </strong></h2>
Emails
URLs

  • http://723pt5dc2plfexrfvudhdhzvesgesqbcl4yivijjubptnogukxxv3hqd.onion</span></h2><h3><br></h3><h1

Targets

    • Target
      2026-09-30_fb23b05580fd55cb97044449fe3f07cf_akira_cobalt-strike_glassworm_rusty-stealer_satacom
    • Size 1.7MB
    • SHA256 fadf86583145544f49d12923ec28bddfdc97633c03d7a466493f1b219137efc7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionimpactransomwarespywarestealer

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks