trigona | 8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0

Resubmissions

21/01/2024, 14:54

240121-r9xcjaddhq10

17/03/2023, 05:51

230317-gj57msed9510

Sharing

Copy URL Twitter E-mail

General

Target
8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0
Size 1.1MB
Sample230317-gj57msed95
SHA256 8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0
MD5 1cd4ab809fb2a9eebb801ab9c9d4a545
SHA1 ce4f4ba93ec1adf8b5c3bac8552fbafd8dcddf27
SHA512 db0476d3193a89104c116805eb34be5ea46774d77745b1e1ecfe48ec5a573e96150e9e48fcd630384c9bb88847ef12b46bd124b4b8ef1a072be4c1b319a76264
SSDEEP 12288:CU5s41o+T7VmjE2Tz23vxO3jWhn370VPWJFwBybD3Y5WrxqnuskDq4:t5swNmjEoujhn3wVPWJFwEQWV+u75
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

trigona

Malware Config

Signatures

Detects Trigona ransomware 1 IoCs

resource	yara_rule
sample	family_trigona

Trigona family
trigona

File Explorer

8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0

.exe 1.1MB

8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0

IMPHASH eb14d66fdcbaead11d7feb704f0e3cdc
SHA256 8804d34b7cf7bd2fc6e20c0dc27da287cee9fccbc52a5630c4752f9cfc6d6cd0
MD5 1cd4ab809fb2a9eebb801ab9c9d4a545
SHA1 ce4f4ba93ec1adf8b5c3bac8552fbafd8dcddf27
SHA512 db0476d3193a89104c116805eb34be5ea46774d77745b1e1ecfe48ec5a573e96150e9e48fcd630384c9bb88847ef12b46bd124b4b8ef1a072be4c1b319a76264
SSDEEP 12288:CU5s41o+T7VmjE2Tz23vxO3jWhn370VPWJFwBybD3Y5WrxqnuskDq4:t5swNmjEoujhn3wVPWJFwEQWV+u75
MD5 SHA1 SHA512 SSDEEP

windows x86

Detects Trigona ransomware

Minor OS version

Major OS version

Entry point

965012

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

SetFileAttributesW SetFileTime GetFileTime QueryDosDeviceW GetACP LocalFree CloseHandle SizeofResource VirtualProtect QueryPerformanceFrequency IsDebuggerPresent FindNextFileW VirtualFree GetFullPathNameW ExitProcess HeapAlloc GetCPInfoExW RtlUnwind SetFilePointerEx GetCPInfo EnumSystemLocalesW GetStdHandle FileTimeToLocalFileTime GetModuleHandleW FreeLibrary TryEnterCriticalSection HeapDestroy FileTimeToDosDateTime ReadFile GetLastError GetModuleFileNameW SetLastError FindResourceW CreateThread CompareStringW GetFileSizeEx LoadLibraryA ResetEvent GetVolumeInformationW FreeResource GetVersion GetDriveTypeW RaiseException MoveFileW FormatMessageW SwitchToThread GetExitCodeThread GetCurrentThread LoadLibraryExW LockResource GetCurrentThreadId UnhandledExceptionFilter VirtualQuery VirtualQueryEx Sleep EnterCriticalSection GetDiskFreeSpaceExW SetFilePointer LoadResource SuspendThread GetTickCount GetStartupInfoW GetFileAttributesW InitializeCriticalSection GetThreadPriority GetCurrentProcess SetThreadPriority VirtualAlloc GetSystemInfo GetCommandLineW GetTempPathW LeaveCriticalSection GetProcAddress ResumeThread GetLogicalDriveStringsW GetVersionExW VerifyVersionInfoW HeapCreate GetWindowsDirectoryW LCMapStringW VerSetConditionMask GetDiskFreeSpaceW FindFirstFileW GetUserDefaultUILanguage lstrlenW SetEndOfFile QueryPerformanceCounter HeapFree WideCharToMultiByte FindClose MultiByteToWideChar CreateMutexA SetEvent CreateFileW GetLocaleInfoW DeleteFileW GetLocalTime WaitForSingleObject WriteFile ExitThread DeleteCriticalSection GetDateFormatW TlsGetValue SetErrorMode GetComputerNameW IsValidLocale TlsSetValue GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc RemoveDirectoryW CreateEventW SetThreadLocale GetThreadLocale

wsock32

gethostbyaddr WSAStartup closesocket socket

ws2_32

WSAIoctl

shell32

ShellExecuteW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

user32

CharUpperBuffA CharUpperBuffW CharNextW MsgWaitForMultipleObjects CharLowerBuffW LoadStringW CharUpperW PeekMessageW GetSystemMetrics GetKeyboardLayoutList MessageBoxW

iphlpapi

GetIpNetTable

oleaut32

SysAllocStringLen SafeArrayPtrOfIndex VariantCopy SafeArrayGetLBound SafeArrayGetUBound VariantInit VariantClear SysFreeString SysReAllocStringLen VariantChangeType SafeArrayCreate

netapi32

NetWkstaGetInfo NetApiBufferFree NetShareEnum

advapi32

RegSetValueExW RegOpenKeyW RegQueryValueExW GetUserNameW RegCloseKey RegOpenKeyExW

Name

.text

Size

935KB

Virtual Size

935KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

26KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

1024B

Virtual Size

524B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

154B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

32B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

83KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ