vebotv.tel_ransome.exe
Ransomware with keylogger and C2
.NET AES file encryptor with ransom demands.NET hook keylogger stages and transmits captured keys
SHA-256dc0cc1eb5f454a8f0ebab68d89c9278cc835d32779a497c5c357d97f089c2760
Evidence
0x39840070282d00000a0b077e27000004284d.p(-.....~'...(M
0x399400000a00077e28000004282000000a00.....~(...( ....
0x39a4007e2900000413041613052b1b110411.~)........+....
0x39b405940c000815fe0116fe010d092d022b.............-.+
0x39c41300110517581305110511048e69fe04.....X.......i..
0x39d40d092dd907283200000a0000de052600..-..(2.......&.
0x39e400de0000002a0000011000000000cb00.....*..........
0x39f467320105010000011e02282600000a2ag2........(&...*
0x3a0442534a4201000100000000000c000000BSJB............
0x3a1476342e302e3330333139000000000500v4.0.30319......
0x3a246c00000094160000237e000000170000l.......#~......
0x3a34c01c000023537472696e677300000000....#Strings....
0x3a44c0330000081e000023555300c8510000.3......#US..Q..
0x3a54100000002347554944000000d8510000....#GUID....Q..
0x3a647407000023426c6f6200000000000000t...#Blob.......
0x3a7402000001579fa2350902000000fa2533....W..5......%3
0x3a8400160000010000006b0000000e000000........k.......
0x3a943d000000750000005c00000004000000=...u...\.......
0x3aa4d6000000150000002e00000001000000................
0x3ab426000000050000000500000005000000&...............
0x3ac4050000001e0000000100000001000000................
0x3ad4050000000500000000000a0001000000................
0x3ae400000600b000a9000600b700a9000600................
0x3af44f01430106001502a90006002202a900O.C........."...
0x3b040600b003 ....
0x69e953243c3e395f5f436163686564416e6fS$<>9__CachedAno
0x69f96e796d6f75734d6574686f6444656c65nymousMethodDele
0x6a0967617465313900456e64735769746800gate19.EndsWith.
0x6a1953797374656d2e53656375726974792eSystem.Security.
0x6a2943727970746f67726170687900416573Cryptography.Aes
0x6a390053796d6d6574726963416c676f7269.SymmetricAlgori
0x6a4974686d007365745f4b6579007365745fthm.set_Key.set_
0x6a594956004943727970746f5472616e7366IV.ICryptoTransf
0x6a696f726d00437265617465456e63727970orm.CreateEncryp
0x6a79746f720043727970746f53747265616dtor.CryptoStream
0x6a890043727970746f53747265616d4d6f64.CryptoStreamMod
0x6a996500577269746500466c75736846696ee.Write.FlushFin
0x6aa9616c426c6f636b00476574456e766972alBlock.GetEnvir
0x6ab96f6e6d656e745661726961626c650044onmentVariable.D
0x6ac9656c6574655375624b65795472656500eleteSubKeyTree.
0x6ad943757272656e74557365720043726561CurrentUser.Crea
0x6ae974655375624b657900417070656e6454teSubKey.AppendT
0x6af965787400436f6c6f72006765745f426cext.Color.get_Bl
0x6b0961636b00466f6e740042727573686573ack.Font.Brushes
0x6b19004272757368006765745f5265640044.Brush.get_Red.D
0x6b29726177537472696e67003c5370616d4drawString.<SpamM
0x6b396f7573653e625f5f3161004353243c3eouse>b__1a.CS$<>
0x6b49395f5f436163686564416e6f6e796d6f9__CachedAnonymo
0x6b5975734d6574686f6444656c6567617465usMethodDelegate
0x6b693162003c426c6f636b5461736b4d616e1b.<BlockTaskMan
0x6b79616765723e625f5f3163004353243c3eager>b__1c.CS$<>
0x6b89395f5f436163686564416e6f6e796d6f9__CachedAnonymo
0x6b9975734d6574686f6444656c6567617465usMethodDelegate
0x6ba93164004b696c6c003c4d6f6e69746f721d.Kill.<Monitor
0x6bb9416e64526573746172743e625f5f3165AndRestart>b__1e
0x6bc9004353243c3e395f5f43616368656441.CS$<>9__CachedA
0x6bd96e6f6e796d6f75734d6574686f644465nonymousMethodDe
0x6be96c656761746531660050726f63657373legate1f.Process
0x6bf95072696f72697479436c617373007365PriorityClass.se
0x6c09745f5072696f72697479436c61737300t_PriorityClass.
0x6c193c3e635f5f446973706c6179436c6173<>c__DisplayClas
0x6c2973323500466f72 s25.For
0x6d6a726465725374796c65007365745f546frderStyle.set_To
0x6d7a704d6f7374007365745f4b6579507265pMost.set_KeyPre
0x6d8a76696577006164645f4b6579446f776eview.add_KeyDown
0x6d9a004576656e7448616e646c6572006164.EventHandler.ad
0x6daa645f4c6f6164004170706c6963617469d_Load.Applicati
0x6dba6f6e0052756e00000000002368007400on.Run.....#h.t.
0x6dca740070003a002f002f00760065006200t.p.:././.v.e.b.
0x6dda6f00740076002e00740065006c000013o.t.v...t.e.l...
0x6dea4b00650079006c006f00670067006500K.e.y.l.o.g.g.e.
0x6dfa720000175b00480048003a006d006d00r...[.H.H.:.m.m.
0x6e0a3a00730073005d002000000720003a00:.s.s.]. ... .:.
0x6e1a200000050d000a00004f43003a005c00 ........OC.:.\.
0x6e2a500072006f006700720061006d004400P.r.o.g.r.a.m.D.
0x6e3a6100740061005c00570069006e006400a.t.a.\.W.i.n.d.
0x6e4a6f007700730055007000640061007400o.w.s.U.p.d.a.t.
0x6e5a65005c006b00650079006c006f006700e.\.k.e.y.l.o.g.
0x6e6a2e00740078007400000f4b0045005900..t.x.t...K.E.Y.
0x6e7a4c004f0047003a000001000d57006500L.O.G.:.....W.e.
0x6e8a6200630061006d00000f770065006200b.c.a.m...w.e.b.
0x6e9a630061006d005f0000092e0062006d00c.a.m._.....b.m.
0x6eaa7000000f570045004200430041004d00p...W.E.B.C.A.M.
0x6eba3a0000154d006900630072006f007000:...M.i.c.r.o.p.
0x6eca68006f006e00650000096d0069006300h.o.n.e...m.i.c.
0x6eda5f0000092e00770061007600001d7000_.....w.a.v...p.
0x6eea6f007700650072007300680065006c00o.w.e.r.s.h.e.l.
0x6efa6c002e0065007800650000819d2d0043l...e.x.e....-.C
0x6f0a006f006d006d0061006e006400200022.o.m.m.a.n.d. ."
0x6f1a004100640064002d0054007900700065.A.d.d.-.T.y.p.e
0x6f2a0020002d0041007300730065006d0062. .-.A.s.s.e.m.b
0x6f3a006c0079004e0061006d006500200053.l.y.N.a.m.e. .S
0x6f4a0079007300740065006d002e00570069.y.s.t.e.m...W.i
0x6f5a006e0064006f00770073002e0046006f.n.d.o.w.s...F.o
0x6f6a0072006d0073003b0020002400720065.r.m.s.;. .$.r.e
0x6f7a00630020003d0020004e00650077002d.c. .=. .N.e.w.-
0x6f8a004f0062006a00650063007400200053.O.b.j.e.c.t. .S
0x6f9a0079007300740065006d002e00570069.y.s.t.e.m...W.i
0x6faa006e0064006f00770073002e0046006f.n.d.o.w.s...F.o
0x6fba0072006d0073002e004100780048006f.r.m.s...A.x.H.o
0x6fca0073007400280027007b003000460035.s.t.(.'.{.0.F.5
0x6fda00380031003900450030002d00330038.8.1.9.E.0.-.3.8
0x6fea00410044002d0031003100440030002d.A.D.-.1.1.D.0.-
0x6ffa0041003400300034002d003000300041.A.4.0.4.-.0.0.A
0x700a0030004300 .0.C.
0x75146100720065005c004e0061006e006f00a.r.e.\.N.a.n.o.
0x752443006f0072006500000f560065007200C.o.r.e...V.e.r.
0x7534730069006f006e00000b31002e003200s.i.o.n...1...2.
0x75442e003000001749006e00730074006100..0...I.n.s.t.a.
0x75546c006c00440061007400650000117300l.l.D.a.t.e...s.
0x7564630068007400610073006b0073000055c.h.t.a.s.k.s..U
0x75742f006300720065006100740065002000/.c.r.e.a.t.e. .
0x75842f0074006e00200022004d0069006300/.t.n. .".M.i.c.
0x759472006f0073006f006600740057006900r.o.s.o.f.t.W.i.
0x75a46e0064006f0077007300550070006400n.d.o.w.s.U.p.d.
0x75b4610074006500220020002f0074007200a.t.e.". ./.t.r.
0x75c4200022000021220020002f0073006300 ."..!". ./.s.c.
0x75d420006f006e006c006f0067006f006e00 .o.n.l.o.g.o.n.
0x75e420002f00660000615300590053005400 ./.f..aS.Y.S.T.
0x75f445004d005c0043007500720072006500E.M.\.C.u.r.r.e.
0x76046e00740043006f006e00740072006f00n.t.C.o.n.t.r.o.
0x76146c005300650074005c0043006f006e00l.S.e.t.\.C.o.n.
0x7624740072006f006c005c00530065007300t.r.o.l.\.S.e.s.
0x7634730069006f006e0020004d0061006e00s.i.o.n. .M.a.n.
0x76446100670065007200001742006f006f00a.g.e.r...B.o.o.
0x765474004500780065006300750074006500t.E.x.e.c.u.t.e.
0x766400030a00001363006d00730074007000......c.m.s.t.p.
0x76742e0065007800650000092f0061007500..e.x.e.../.a.u.
0x7684200000196500760065006e0074007600 ...e.v.e.n.t.v.
0x7694770072002e0065007800650000808348w.r...e.x.e....H
0x76a4004b00450059005f0043005500520052.K.E.Y._.C.U.R.R
0x76b40045004e0054005f0055005300450052.E.N.T._.U.S.E.R
0x76c4005c0053006f00660074007700610072.\.S.o.f.t.w.a.r
0x76d40065005c0043006c0061007300730065.e.\.C.l.a.s.s.e
0x76e40073005c006d0073002d007300650074.s.\.m.s.-.s.e.t
0x76f400740069006e00670073005c00730068.t.i.n.g.s.\.s.h
0x77040065006c006c005c006f00700065006e.e.l.l.\.o.p.e.n
0x7714005c0063006f006d006d0061006e0064.\.c.o.m.m.a.n.d
0x772400011f440065006c0065006700610074...D.e.l.e.g.a.t
0x773400650045007800650063007500740065.e.E.x.e.c.u.t.e
0x774400001b66006f006400680065006c0070...f.o.d.h.e.l.p
0x775400650072002e0065007800650000813d.e.r...e.x.e...=
0x77642d0043006f006d006d0061006e006400-.C.o.m.m.a.n.d.
0x7774200022005300650074002d004d007000 .".S.e.t.-.M.p.
0x778450007200650066006500720065006e00P.r.e.f.e.r.e.n.
0x77946300650020002d004400690073006100c.e. .-.D.i.s.a.
0x77a462006c0065005200650061006c007400b.l.e.R.e.a.l.t.
0x77b469006d0065004d006f006e0069007400i.m.e.M.o.n.i.t.
0x77c46f00720069006e006700200024007400o.r.i.n.g. .$.t.
0x77d47200750065003b002000530065007400r.u.e.;. .S.e.t.
0x77e42d004d00700050007200650066006500-.M.p.P.r.e.f.e.
0x77f4720065006e006300650020002d004400r.e.n.c.e. .-.D.
0x780469007300610062006c00650049004f00i.s.a.b.l.e.I.O.
0x846066000017430072006500640065006e00f...C.r.e.d.e.n.
0x84707400690061006c007300001342006f00t.i.a.l.s...B.o.
0x84806f006b006d00610072006b007300000fo.k.m.a.r.k.s...
0x84902e00730074006f006c0065006e00001b..s.t.o.l.e.n...
0x84a06b006100730070006500720073006b00k.a.s.p.e.r.s.k.
0x84b079002e0063006f006d0000156d006300y...c.o.m...m.c.
0x84c061006600650065002e0063006f006d00a.f.e.e...c.o.m.
0x84d00019730079006d0061006e0074006500..s.y.m.a.n.t.e.
0x84e063002e0063006f006d00001361007600c...c.o.m...a.v.
0x84f06100730074002e0063006f006d00001fa.s.t...c.o.m...
0x850062006900740064006500660065006e00b.i.t.d.e.f.e.n.
0x85106400650072002e0063006f006d000011d.e.r...c.o.m...
0x852065007300650074002e0063006f006d00e.s.e.t...c.o.m.
0x8530001d7400720065006e0064006d006900..t.r.e.n.d.m.i.
0x8540630072006f002e0063006f006d000021c.r.o...c.o.m..!
0x85506d0061006c0077006100720065006200m.a.l.w.a.r.e.b.
0x856079007400650073002e0063006f006d00y.t.e.s...c.o.m.
0x8570001d7600690072007500730074006f00..v.i.r.u.s.t.o.
0x8580740061006c002e0063006f006d000015t.a.l...c.o.m...
0x85903100320037002e0030002e0030002e001.2.7...0...0...
0x85a031002000001b570061006e006e0061001. ...W.a.n.n.a.
0x85b04300720079004d007500740065007800C.r.y.M.u.t.e.x.
0x85c000194c006f0063006b00420069007400..L.o.c.k.B.i.t.
0x85d04d007500740065007800002148006900M.u.t.e.x..!H.i.
0x85e06400640065006e005400650061007200d.d.e.n.T.e.a.r.
0x85f073004d00750074006500780000135200s.M.u.t.e.x...R.
0x8600790075006b004d007500740065007800y.u.k.M.u.t.e.x.
0x8610001552004500760069006c004d007500..R.E.v.i.l.M.u.
0x8620740065007800000f47006c006f006200t.e.x...G.l.o.b.
0x863061006c005c000011770061006c006c00a.l.\...w.a.l.l.
0x86402e0062006d007000003359004f005500..b.m.p..3Y.O.U.
0x865052002000460049004c00450053002000R. .F.I.L.E.S. .
0x8660410052004500200045004e0043005200A.R.E. .E.N.C.R.
0x8670590050005400450044002100000b4100Y.P.T.E.D.!...A.
0x86807200690061006c00002b43006f006e00r.i.a.l..+C.o.n.
0x8690740072006f006c002000500061006e00t.r.o.l. .P.a.n.
0x86a065006c005c004400650073006b007400e.l.\.D.e.s.k.t.
0x86b06f0070000013570061006c006c007000o.p...W.a.l.l.p.
0x86c06100700065007200001d570061006c00a.p.e.r...W.a.l.
0x86d06c007000610070006500720053007400l.p.a.p.e.r.S.t.
0x86e079006c006500000332000080eb3d003dy.l.e...2....=.=
0x86f0003d002000520041004e0053004f004d.=. .R.A.N.S.O.M
0x87000020004e004f005400450020003d003d. .N.O.T.E. .=.=
0x8710003d000a0059006f0075007200200066.=...Y.o.u.r. .f
0x87200069006c006500730020006800610076.i.l.e.s. .h.a.v
0x873000650020006200650065006e00200065.e. .b.e.e.n. .e
0x8740006e0063007200790070007400650064.n.c.r.y.p.t.e.d
0x875000200077006900740068002000410045. .w.i.t.h. .A.E