trigona | fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b[.]exe

Resubmissions

21/01/2024, 14:53

240121-r9d6ysead310

18/04/2023, 10:19

230418-mclsbacf2v10

Sharing

Copy URL Twitter E-mail

General

Target
fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe
Size 1.1MB
Sample230418-mclsbacf2v
SHA256 fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b
MD5 530967fb3b7d9427552e4ac181a37b9a
SHA1 41bcf469661ab9609a0d181953c2f8ffb75bb483
SHA512 b81a447a994839a6858bab10eaa2c26aabaf3f73e7ffd2c70d27dfde5f11b35f5d153362277c046d47bcf9dc2d2b7c92d5805e89e633f9326306071abb213afa
SSDEEP 24576:15swNmjEoujhn3wVPWJFwEQWV+u7h62TL:HouNVOEbcah6qL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

trigona

Malware Config

Signatures

Detects Trigona ransomware 1 IoCs

resource	yara_rule
sample	family_trigona

Trigona family
trigona

File Explorer

fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe

.exe 1.1MB

fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.exe

IMPHASH eb14d66fdcbaead11d7feb704f0e3cdc
SHA256 fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b
MD5 530967fb3b7d9427552e4ac181a37b9a
SHA1 41bcf469661ab9609a0d181953c2f8ffb75bb483
SHA512 b81a447a994839a6858bab10eaa2c26aabaf3f73e7ffd2c70d27dfde5f11b35f5d153362277c046d47bcf9dc2d2b7c92d5805e89e633f9326306071abb213afa
SSDEEP 24576:15swNmjEoujhn3wVPWJFwEQWV+u7h62TL:HouNVOEbcah6qL
MD5 SHA1 SHA512 SSDEEP

windows x86

Detects Trigona ransomware

Minor OS version

Major OS version

Entry point

965012

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

SetFileAttributesW SetFileTime GetFileTime QueryDosDeviceW GetACP LocalFree CloseHandle SizeofResource VirtualProtect QueryPerformanceFrequency IsDebuggerPresent FindNextFileW VirtualFree GetFullPathNameW ExitProcess HeapAlloc GetCPInfoExW RtlUnwind SetFilePointerEx GetCPInfo EnumSystemLocalesW GetStdHandle FileTimeToLocalFileTime GetModuleHandleW FreeLibrary TryEnterCriticalSection HeapDestroy FileTimeToDosDateTime ReadFile GetLastError GetModuleFileNameW SetLastError FindResourceW CreateThread CompareStringW GetFileSizeEx LoadLibraryA ResetEvent GetVolumeInformationW FreeResource GetVersion GetDriveTypeW RaiseException MoveFileW FormatMessageW SwitchToThread GetExitCodeThread GetCurrentThread LoadLibraryExW LockResource GetCurrentThreadId UnhandledExceptionFilter VirtualQuery VirtualQueryEx Sleep EnterCriticalSection GetDiskFreeSpaceExW SetFilePointer LoadResource SuspendThread GetTickCount GetStartupInfoW GetFileAttributesW InitializeCriticalSection GetThreadPriority GetCurrentProcess SetThreadPriority VirtualAlloc GetSystemInfo GetCommandLineW GetTempPathW LeaveCriticalSection GetProcAddress ResumeThread GetLogicalDriveStringsW GetVersionExW VerifyVersionInfoW HeapCreate GetWindowsDirectoryW LCMapStringW VerSetConditionMask GetDiskFreeSpaceW FindFirstFileW GetUserDefaultUILanguage lstrlenW SetEndOfFile QueryPerformanceCounter HeapFree WideCharToMultiByte FindClose MultiByteToWideChar CreateMutexA SetEvent CreateFileW GetLocaleInfoW DeleteFileW GetLocalTime WaitForSingleObject WriteFile ExitThread DeleteCriticalSection GetDateFormatW TlsGetValue SetErrorMode GetComputerNameW IsValidLocale TlsSetValue GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc RemoveDirectoryW CreateEventW SetThreadLocale GetThreadLocale

wsock32

gethostbyaddr WSAStartup closesocket socket

ws2_32

WSAIoctl

shell32

ShellExecuteW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

user32

CharUpperBuffA CharUpperBuffW CharNextW MsgWaitForMultipleObjects CharLowerBuffW LoadStringW CharUpperW PeekMessageW GetSystemMetrics GetKeyboardLayoutList MessageBoxW

iphlpapi

GetIpNetTable

oleaut32

SysAllocStringLen SafeArrayPtrOfIndex VariantCopy SafeArrayGetLBound SafeArrayGetUBound VariantInit VariantClear SysFreeString SysReAllocStringLen VariantChangeType SafeArrayCreate

netapi32

NetWkstaGetInfo NetApiBufferFree NetShareEnum

advapi32

RegSetValueExW RegOpenKeyW RegQueryValueExW GetUserNameW RegCloseKey RegOpenKeyExW

Name

.text

Size

935KB

Virtual Size

935KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

26KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

1024B

Virtual Size

524B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

154B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

32B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

83KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ