socolive98.tv_chrome.exe
Ransomware with keylogger and C2
.NET AES file encryptor with ransom demands.NET low-level hook keylogger with HTTP upload
SHA-2564b92a93071d26412f667ef170660d664dcd1d70255a9003bf8ef2b9eee2c2bad
Evidence
0x54d47265390070281300000a802b00000472re9.p(.....+...r
0x54e473390070802c0000047e260000047289s9.p.,...~&...r.
0x54f4390070281300000a802d00000428a9009.p(.....-...(..
0x5504000a72a33900706f9d00000a802e0000..r.9.po........
0x55140428a900000a72c73900706f9d00000a.(....r.9.po....
0x5524802f0000047e6100000a803100000473./...~a....1...s
0x5534c700000a803200000472ff0100708033.....2...r...p.3
0x554400000472ff01007080340000042a0000...r...p.4...*..
0x555442534a4201000100000000000c000000BSJB............
0x556476342e302e3330333139000000000500v4.0.30319......
0x55746c0000009c1c0000237e0000081d0000l.......#~......
0x5584c022000023537472696e677300000000."..#Strings....
0x5594c83f0000e839000023555300b0790000.?...9..#US..y..
0x55a4100000002347554944000000c0790000....#GUID....y..
0x55b4dc0b000023426c6f6200000000000000....#Blob.......
0x55c402000001579f023e090a000000fa2533....W..>......%3
0x55d40016000001000000690000000f000000........i.......
0x55e47e000000a30000005f00000009000000~......._.......
0x55f4c7000000210000006300000001000000....!...c.......
0x560444000000120000000300000002000000D...............
0x56141c000000010000000100000005000000................
0x56240c0000001200000000000a0001000000................
0x56340000060061005a00060068005a000600....a.Z...h.Z...
0x5644a20396030600f405dd0506001f0b5a00..............Z.
0x565406002c0b ..,.
0xa29f0077006f007a002e006e0073002e0063.w.o.z...n.s...c
0xa2af006c006f007500640066006c00610072.l.o.u.d.f.l.a.r
0xa2bf0065002e0063006f006d000017410070.e...c.o.m...A.p
0xa2cf0070006c00690063006100740069006f.p.l.i.c.a.t.i.o
0xa2df006e00001f5300650072007600690063.n...S.e.r.v.i.c
0xa2ef00650020007300740061007200740065.e. .s.t.a.r.t.e
0xa2ff006400005b53004f0046005400570041.d..[S.O.F.T.W.A
0xa30f00520045005c004d006900630072006f.R.E.\.M.i.c.r.o
0xa31f0073006f00660074005c00570069006e.s.o.f.t.\.W.i.n
0xa32f0064006f00770073005c004300750072.d.o.w.s.\.C.u.r
0xa33f00720065006e00740056006500720073.r.e.n.t.V.e.r.s
0xa34f0069006f006e005c00520075006e0000.i.o.n.\.R.u.n..
0xa35f13530079007300550070006400610074.S.y.s.U.p.d.a.t
0xa36f006500001b5300790073005500700064.e...S.y.s.U.p.d
0xa37f006100740065002e0065007800650000.a.t.e...e.x.e..
0xa38f117300630068007400610073006b0073.s.c.h.t.a.s.k.s
0xa39f0000432f006300720065006100740065..C/.c.r.e.a.t.e
0xa3af0020002f0074006e0020002200530079. ./.t.n. .".S.y
0xa3bf00730055007000640061007400650054.s.U.p.d.a.t.e.T
0xa3cf00610073006b00220020002f00740072.a.s.k.". ./.t.r
0xa3df00200022000021220020002f00730063. ."..!". ./.s.c
0xa3ef0020006f006e006c006f0067006f006e. .o.n.l.o.g.o.n
0xa3ff0020002f00660000472f006300720065. ./.f..G/.c.r.e
0xa40f0061007400650020002f0074006e0020.a.t.e. ./.t.n.
0xa41f00220053007900730055007000640061.".S.y.s.U.p.d.a
0xa42f00740065004200610063006b00750070.t.e.B.a.c.k.u.p
0xa43f00220020002f00740072002000220000.". ./.t.r. ."..
0xa44f2d220020002f007300630020006d0069-". ./.s.c. .m.i
0xa45f006e0075007400650020002f006d006f.n.u.t.e. ./.m.o
0xa46f0020003300300020002f006600000320. .3.0. ./.f...
0xa47f0000155b00480048003a006d006d003a...[.H.H.:.m.m.:
0xa48f00730073005d00000520002800000529.s.s.]... .(...)
0xa49f00200000050d000a00000f4b00450059. .........K.E.Y
0xa4af004c004f0047003a0000035b0000055d.L.O.G.:...[...]
0xa4bf00200000030a00000b43004c00490050. .......C.L.I.P
0xa4cf003a0000097300630072005f00001f79.:...s.c.r._...y
0xa4df007900790079004d004d00640064005f.y.y.y.M.M.d.d._
0xa4ef00480048006d006d007300730000092e.H.H.m.m.s.s....
0xa4ff006a0070006700000f53004300520045.j.p.g...S.C.R.E
0xa50f0045004e003a00001344006f0077006e.E.N.:...D.o.w.n
0xa51f006c006f0061006400730000092e0074.l.o.a.d.s.....t
0xa52f007800740000092e0064006f00630000.x.t.....d.o.c..
0xa53f0b2e0064006f006300780000092e0070...d.o.c.x.....p
0xa54f006400660000092e0078006c00730000.d.f.....x.l.s..
0xa55f0b2e0078006c007300780000092e0070...x.l.s.x.....p
0xa56f006e00670000092e007a006900700000.n.g.....z.i.p..
0xa57f032a00000f2e00730074006f006c0065.*.....s.t.o.l.e
0xa58f006e00000b460049004c0045003a0000.n...F.I.L.E.:..
0xab132d002d00200042006100730065003600-.-. .B.a.s.e.6.
0xab233400200062006f0074006e00650074004. .b.o.t.n.e.t.
0xab333a0020000180ab0d000a002d002d0020:. ........-.-.
0xab4300540068006900730020005000440046.T.h.i.s. .P.D.F
0xab5300200063006f006e007400610069006e. .c.o.n.t.a.i.n
0xab630073002000610020006d0061006c0077.s. .a. .m.a.l.w
0xab73006100720065002e00200050006c0065.a.r.e... .P.l.e
0xab83006100730065002000720075006e0020.a.s.e. .r.u.n.
0xab9300740068006500200061007400740061.t.h.e. .a.t.t.a
0xaba300630068006500640020006500780065.c.h.e.d. .e.x.e
0xabb300630075007400610062006c00650020.c.u.t.a.b.l.e.
0xabc30074006f002000760069006500770020.t.o. .v.i.e.w.
0xabd30063006f006e00740065006e0074002e.c.o.n.t.e.n.t..
0xabe3000180810d000a005300650074002000........S.e.t. .
0xabf36f005700530020003d00200057005300o.W.S. .=. .W.S.
0xac03630072006900700074002e0043007200c.r.i.p.t...C.r.
0xac1365006100740065004f0062006a006500e.a.t.e.O.b.j.e.
0xac2363007400280022005700530063007200c.t.(.".W.S.c.r.
0xac336900700074002e005300680065006c00i.p.t...S.h.e.l.
0xac436c00220029000d000a0073004c006900l.".).....s.L.i.
0xac536e006b00460069006c00650020003d00n.k.F.i.l.e. .=.
0xac6320002200002d49006d0070006f007200 ."..-I.m.p.o.r.
0xac73740061006e0074005f0044006f006300t.a.n.t._.D.o.c.
0xac8375006d0065006e0074002e006c006e00u.m.e.n.t...l.n.
0xac936b0000808522000d000a005300650074k....".....S.e.t
0xaca30020006f004c0069006e006b0020003d. .o.L.i.n.k. .=
0xacb30020006f00570053002e004300720065. .o.W.S...C.r.e
0xacc300610074006500530068006f00720074.a.t.e.S.h.o.r.t
0xacd300630075007400280073004c0069006e.c.u.t.(.s.L.i.n
0xace3006b00460069006c00650029000d000a.k.F.i.l.e.)....
0xacf3006f004c0069006e006b002e00540061.o.L.i.n.k...T.a
0xad0300720067006500740050006100740068.r.g.e.t.P.a.t.h
0xad130020003d0020002200001b22000d000a. .=. ."..."....
0xad23006f004c0069006e006b002e00530061.o.L.i.n.k...S.a
0xad33007600650000176d0061006b0065006c.v.e...m.a.k.e.l
0xad43006e006b002e00760062007300001777.n.k...v.b.s...w
0xad53007300630072006900700074002e0065.s.c.r.i.p.t...e
0xad630078006500002f530079007300740065.x.e../S.y.s.t.e
0xad73006d0056006f006c0075006d00650049.m.V.o.l.u.m.e.I
0xad83006e0066006f0072006d006100740069.n.f.o.r.m.a.t.i
0xad93006f006e00000964006f0063005f0000.o.n...d.o.c._..
0xada32742006f0074006e0065007400200050'B.o.t.n.e.t. .P
0xadb30044004600200063006f006e00740065.D.F. .c.o.n.t.e
0xadc3006e0074002000001350004400460042.n.t. ...P.D.F.B
0xadd3006f0074006e00650074000039500044.o.t.n.e.t..9P.D
0xade300460042006f0074006e00650074005c.F.B.o.t.n.e.t.\
0xadf3007300680065006c006c005c006f0070.s.h.e.l.l.\.o.p
0xae030065006e005c0063006f006d006d0061.e.n.\.c.o.m.m.a
0xb6d678006500000d77007300630073007600x.e...w.s.c.s.v.
0xb6e66300002b530065006300750072006900c..+S.e.c.u.r.i.
0xb6f6740079004800650061006c0074006800t.y.H.e.a.l.t.h.
0xb70653006500720076006900630065000013S.e.r.v.i.c.e...
0xb716570069006e0044006500660065006e00W.i.n.D.e.f.e.n.
0xb7266400000f4d0073004d00700053007600d...M.s.M.p.S.v.
0xb7366300000573006300000b730074006f00c...s.c...s.t.o.
0xb74670002000000f63006f006e0066006900p. ...c.o.n.f.i.
0xb75667002000002120007300740061007200g. ..! .s.t.a.r.
0xb76674003d00200064006900730061006200t.=. .d.i.s.a.b.
0xb7766c0065006400001b6b00610073007000l.e.d...k.a.s.p.
0xb7866500720073006b0079002e0063006f00e.r.s.k.y...c.o.
0xb7966d0000156d0063006100660065006500m...m.c.a.f.e.e.
0xb7a62e0063006f006d000019730079006d00..c.o.m...s.y.m.
0xb7b661006e007400650063002e0063006f00a.n.t.e.c...c.o.
0xb7c66d000013610076006100730074002e00m...a.v.a.s.t...
0xb7d663006f006d00001f6200690074006400c.o.m...b.i.t.d.
0xb7e66500660065006e006400650072002e00e.f.e.n.d.e.r...
0xb7f663006f006d0000116500730065007400c.o.m...e.s.e.t.
0xb8062e0063006f006d00001d740072006500..c.o.m...t.r.e.
0xb8166e0064006d006900630072006f002e00n.d.m.i.c.r.o...
0xb82663006f006d0000216d0061006c007700c.o.m..!m.a.l.w.
0xb83661007200650062007900740065007300a.r.e.b.y.t.e.s.
0xb8462e0063006f006d00001d760069007200..c.o.m...v.i.r.
0xb8567500730074006f00740061006c002e00u.s.t.o.t.a.l...
0xb86663006f006d0000153100320037002e00c.o.m...1.2.7...
0xb87630002e0030002e0031002000001b57000...0...1. ...W.
0xb88661006e006e0061004300720079004d00a.n.n.a.C.r.y.M.
0xb896750074006500780000194c006f006300u.t.e.x...L.o.c.
0xb8a66b004200690074004d00750074006500k.B.i.t.M.u.t.e.
0xb8b678000021480069006400640065006e00x..!H.i.d.d.e.n.
0xb8c6540065006100720073004d0075007400T.e.a.r.s.M.u.t.
0xb8d66500780000135200790075006b004d00e.x...R.y.u.k.M.
0xb8e675007400650078000015520045007600u.t.e.x...R.E.v.
0xb8f669006c004d007500740065007800000fi.l.M.u.t.e.x...
0xb90647006c006f00620061006c005c000029G.l.o.b.a.l.\..)
0xb916520061006e0073006f006d0077006100R.a.n.s.o.m.w.a.
0xb92672006500530069006d0075006c006100r.e.S.i.m.u.l.a.
0xb936740069006f006e000045460069006c00t.i.o.n..EF.i.l.
0xb94665007300200065006e00630072007900e.s. .e.n.c.r.y.
0xb95670007400650064002e00200050006100p.t.e.d... .P.a.
0xb96679006d0065006e007400200072006500y.m.e.n.t. .r.e.
0xb9767100750069007200650064002e000039q.u.i.r.e.d....9
0xb98653006f00660074007700610072006500S.o.f.t.w.a.r.e.
0xb9965c0043006c0061007300730065007300\.C.l.a.s.s.e.s.
0xb9a65c006d0073002d007300650074007400\.m.s.-.s.e.t.t.
0xb9b669006e0067007300015f53006f006600i.n.g.s.._S.o.f.
0xb9c6740077006100720065005c0043006c00t.w.a.r.e.\.C.l.
0xbcdf42007900700061007300730020002d00B.y.p.a.s.s. .-.
0xbcef45006e00630020000115730079007300E.n.c. ...s.y.s.
0xbcff740065006d002e006200610074000029t.e.m...b.a.t..)
0xbd0f40006500630068006f0020006f006600@.e.c.h.o. .o.f.
0xbd1f66000a00730074006100720074002000f...s.t.a.r.t. .
0xbd2f2200220020002200000522000a00001b".". ."...".....
0xbd3f570069006e00330032005f0050007200W.i.n.3.2._.P.r.
0xbd4f6f006300650073007300000d43007200o.c.e.s.s...C.r.
0xbd5f6500610074006500001743006f006d00e.a.t.e...C.o.m.
0xbd6f6d0061006e0064004c0069006e006500m.a.n.d.L.i.n.e.
0xbd7f000f640065006c002e00620061007400..d.e.l...b.a.t.
0xbd8f0077760073007300610064006d006900.wv.s.s.a.d.m.i.
0xbd9f6e002000640065006c00650074006500n. .d.e.l.e.t.e.
0xbdaf200073006800610064006f0077007300 .s.h.a.d.o.w.s.
0xbdbf20002f0061006c006c0020002f007100 ./.a.l.l. ./.q.
0xbdcf75006900650074000a0077006d006900u.i.e.t...w.m.i.
0xbddf6300200073006800610064006f007700c. .s.h.a.d.o.w.
0xbdef63006f00700079002000640065006c00c.o.p.y. .d.e.l.
0xbdff6500740065000a00000f43004f004f00e.t.e.....C.O.O.
0xbe0f4b00490045003a00003f63006f006e00K.I.E.:..?c.o.n.
0xbe1f66006900670020006900380030003400f.i.g. .i.8.0.4.
0xbe2f320070007200740020007300740061002.p.r.t. .s.t.a.
0xbe3f720074003d0020006400690073006100r.t.=. .d.i.s.a.
0xbe4f62006c0065006400001b730074006f00b.l.e.d...s.t.o.
0xbe5f70002000690038003000340032007000p. .i.8.0.4.2.p.
0xbe6f72007400001753007900730074006500r.t...S.y.s.t.e.
0xbe7f6d004400720069007600650000115300m.D.r.i.v.e...S.
0xbe8f4300520041005000450044003a000015C.R.A.P.E.D.:...
0xbe9f48004500410052005400420045004100H.E.A.R.T.B.E.A.
0xbeaf54003a0000037c0000194b0045005900T.:...|...K.E.Y.
0xbebf4c004f0047005f00420055004c004b00L.O.G._.B.U.L.K.
0xbecf3a00001543004c00490050005f004200:...C.L.I.P._.B.
0xbedf55004c004b003a0000053a002000000fU.L.K.:...:. ...
0xbeef63006d0064002e006500780065000023c.m.d...e.x.e..#
0xbeff2f006300200073007900730074006500/.c. .s.y.s.t.e.
0xbf0f6d0069006e0066006f0020003e002000m.i.n.f.o. .>. .
0xbf1f2200001773007900730069006e006600"...s.y.s.i.n.f.
0xbf2f6f002e00740078007400001f2f006300o...t.x.t.../.c.
0xbf3f20007400610073006b006c0069007300 .t.a.s.k.l.i.s.
0xbf4f740020003e0020002200001974006100t. .>. ."...t.a.
0xbf5f73006b006c006900730074002e007400s.k.l.i.s.t...t.
0xbf6f78007400001b2f006300200077006800x.t.../.c. .w.h.
0xbf7f6f0061006d00690020003e0020002200o.a.m.i. .>. .".
0xbf8f0015770068006f0061006d0069002e00..w.h.o.a.m.i...
0xbf9f740078007400001f2f00630020006e00t.x.t.../.c. .n.
0xbfaf65007400200075007300650072002000e.t. .u.s.e.r. .
0xbfbf3e002000220000176e00650074007500>. ."...n.e.t.u.
0xbfcf7300650072002e007400780074000029s.e.r...t.x.t..)