Hostile ^93% windows download unavailable

file.exe

Sextortion malware with C2 and ransom

PE SMTP mailer discovers public IP and deletes web provenancePE direct-SMTP sextortion mailer

SHA-256d90d1bd6eb379fa5e2e910be754d95c5f395e804bd00799f5fcf74e02eeff972

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₄(C₂Ca₂ILa)H₅(Cm₈DbF₂PoTi)Md(Bi)Th

Evidence

English function-word token "this" 0x0–0xb0

⋯3 more rows
0x30000000000000000000000000d8000000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯6 more rows

PE direct-SMTP sextortion mailer 0x2850–0x2b40

⋯3 more rows
0x28803275000079616e6465782e72750000002u..yandex.ru...
0x28904d6f7a696c6c612f352e30202857696eMozilla/5.0 (Win
0x28a0646f7773204e542031302e303b205769dows NT 10.0; Wi
⋯4 more rows
0x28f036342e313130205361666172692f353364.110 Safari/53
0x2900372e333600000000687474703a2f2f697.36....http://i
0x291063616e68617a69702e636f6d2f000000canhazip.com/...
0x29202e0000005b25735d000000005b302e30....[%s]....[0.0
⋯16 more rows
0x2a3037002e003300360000000000000000007...3.6.........
0x2a4045534d545000000045484c4f2025730dESMTP...EHLO %s.
0x2a500a00000048454c4f2025730d0a000000....HELO %s.....
0x2a603c25733e000000004d41494c2046524f<%s>....MAIL FRO
0x2a704d3a2025730d0a005243505420544f3aM: %s...RCPT TO:
0x2a80203c25733e0d0a00444154410d0a0000 <%s>...DATA....
0x2a9025732e636f6d00005265636569766564%s.com..Received
0x2aa03a2066726f6d20257320285b25642e25: from %s ([%d.%
0x2ab0642e25642e25645d2920627920257320d.%d.%d]) by %s 
0x2ac077697468204d61696c456e61626c6520with MailEnable 
0x2ad045534d54503b2025730d0a0052656365ESMTP; %s...Rece
⋯7 more rows

English function-word token "for" 0x2b8e–0x2c3e

0x2b8e00004869210d0a0d0a00556e666f7274..Hi!.....Unfort
0x2b9e756e6174656c792c2074686572652069unately, there i
0x2bae7320736f6d6520626164206e65777320s some bad news 
0x2bbe666f7220796f752e0d0a0d0a00000000for you.........
0x2bce0000536f6d652074696d652061676f2c..Some time ago,
⋯7 more rows

PE SMTP mailer discovers public IP and deletes web provenance 0x33e4–0x3584

⋯3 more rows
0x34140000000051554954000000003a000000....QUIT....:...
0x34242500740065006d007000250000000000%.t.e.m.p.%.....
0x3434250073006e002e007400780074000000%.s.n...t.x.t...
0x344425007300250064002e00740078007400%.s.%.d...t.x.t.
0x345400000000250073005c00250064002500....%.s.\.%.d.%.
0x34646400250064002e006a00700067000000d.%.d...j.p.g...
0x34740000000000000000c0ffdf4025007300...........@%.s.
0x34843a005a006f006e0065002e0049006400:.Z.o.n.e...I.d.
0x349465006e00740069006600690065007200e.n.t.i.f.i.e.r.
⋯15 more rows

IsDebuggerPresent API name in PE strings 0x3cce–0x3dae

⋯3 more rows
0x3cfe657074696f6e46696c7465720000d102eptionFilter....
0x3d0e4973446562756767657250726573656eIsDebuggerPresen
0x3d1e74004b45524e454c33322e646c6c0000t.KERNEL32.dll..
0x3d2e070377737072696e7466410008037773..wsprintfA...ws
⋯8 more rows