Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

4kvideodow...ck.exe

windows7_x64

10

4kvideodow...ck.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4kvideodownloader_4.18_x64Crack.exe

  • Size

    24.3MB

  • Sample

    211230-shylyseebr

  • MD5

    346b3c83128f1918b162694eec15963d

  • SHA1

    8c363d01e47d6dffd66044b1a34a78c5a1aac59c

  • SHA256

    d6c39d7d9be421b66517d195180f7156c52c3fadba440d5d3d26ff6b1d45aa1a

  • SHA512

    d69ec8e35d293f0b78543ddef48d9a4e2e2b4c372336ddb70a5aa4438611c8517b84d344fb250f7a3b14b1cde0d5eb963a9145c82b72f2e1ef807ded385cba6c

Score
10/10
pyinstallerransomwarespywarestealer

Malware Config

Extracted

Path

C:\README.txt

Ransom Note
Do not close this message !!! Hi, don't worry. All of your files have been encrypted. To return your files, you need to send 0.003 bitcoin to the address 1NNLcGozxxNmFypZB4rgnmvuCju2pxfAQQ if within 10 hours there is no payment, all your files will be deleted ... You can pay through various crypto-exchanges (Binance, Coinbase and others), crypto exchanges or from your personal bitcoin wallet. After payment you will receive a decoder and an unlock key and all your files will be unlocked. Do not try to unlock it yourself, you will only waste time, and after 10 hours all files will be deleted. A strong encryption method is used for encryption. Communication after payment telegram: @crypto_support_id_43274
Wallets

1NNLcGozxxNmFypZB4rgnmvuCju2pxfAQQ

Targets

    • Target

      4kvideodownloader_4.18_x64Crack.exe

    • Size

      24.3MB

    • MD5

      346b3c83128f1918b162694eec15963d

    • SHA1

      8c363d01e47d6dffd66044b1a34a78c5a1aac59c

    • SHA256

      d6c39d7d9be421b66517d195180f7156c52c3fadba440d5d3d26ff6b1d45aa1a

    • SHA512

      d69ec8e35d293f0b78543ddef48d9a4e2e2b4c372336ddb70a5aa4438611c8517b84d344fb250f7a3b14b1cde0d5eb963a9145c82b72f2e1ef807ded385cba6c

    Score
    10/10
    ransomwarespywarestealer

    • Drops file in Drivers directory

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks