Overview

overview

10

Static

static

10

sample.exe

windows7-x64

10

sample.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b.bin.sample.gz

  • Size

    464KB

  • Sample

    240228-nejleaac24

  • MD5

    02c8dfae2b715421e4f4c211b7e95d48

  • SHA1

    a9eb41bd1f35630088ec434fd604498628fd8e57

  • SHA256

    37daa45c67b275cd454dc6f5b45a168d0054bb904ba97e26f27bbe377c2a8c6b

  • SHA512

    9d1d907fe638360f0e55bac57c26bd4791f8d5a9e3441e122def98ea87cdd304ebd95bd5a10a4a79b5a9d149a3288944ca3ed3e1eded162d437a8bc3fda6e8e6

  • SSDEEP

    12288:LEPUIpu6UuU9MK3/S8pB5ww3hBnFvpoeDAsYMzUTKE:LGgr3/SqB5z3bpfTCTd

Score
10/10
trigonapersistenceransomwarespywarestealer

Malware Config

Targets

    • Target

      sample

    • Size

      1.1MB

    • MD5

      530967fb3b7d9427552e4ac181a37b9a

    • SHA1

      41bcf469661ab9609a0d181953c2f8ffb75bb483

    • SHA256

      fb128dbd4e945574a2795c2089340467fcf61bb3232cc0886df98d86ff328d1b

    • SHA512

      b81a447a994839a6858bab10eaa2c26aabaf3f73e7ffd2c70d27dfde5f11b35f5d153362277c046d47bcf9dc2d2b7c92d5805e89e633f9326306071abb213afa

    • SSDEEP

      24576:15swNmjEoujhn3wVPWJFwEQWV+u7h62TL:HouNVOEbcah6qL

    Score
    10/10
    trigonapersistenceransomwarespywarestealer

    • Detects Trigona ransomware

    • Trigona

      A ransomware first seen at the beginning of the 2022.

      ransomwaretrigona

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks