Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

26bd4a40d1...b7.exe

windows7-x64

10

26bd4a40d1...b7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    54e86caeee3b5324a55b98b2855f56dfcd4624681e5d2f0cb58558be8e40e896

  • Size

    628KB

  • Sample

    240417-r8yh7sed5y

  • MD5

    edcb26f29a7f21aaff0fafcebd3ec743

  • SHA1

    dc14a67b6f5c693dd3e44581eb551de92d3db123

  • SHA256

    54e86caeee3b5324a55b98b2855f56dfcd4624681e5d2f0cb58558be8e40e896

  • SHA512

    b40886ca10c9a3577717029c70a69dc11772d9c22a2c4f6b00275f8b92876894a8d1b592ef3350d08f3906c2b938247e81fc13d3d7bd0410780e21153e189257

  • SSDEEP

    12288:JkA5Rt4dhjGvd9pq5QZ4ivDv5wDy+YrfOY8wS8Zez1TPSn7lBX9g/cbCjf8Hqi+X:JrCtGFa5cvDBLOY8b8ZezC7lBX9gLB

Score
10/10
djvudiscoverypersistenceransomware

Malware Config

Extracted

Family

djvu

C2

http://zexeq.com/test1/get.php

Attributes
  • extension

    .cdqw

  • offline_id

    mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1

  • payload_url

    http://brusuax.com/dl/build2.exe

    http://zexeq.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-99MNqXMrdS Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0840ASdw

rsa_pubkey.plain

Targets

    • Target

      26bd4a40d12d5483b5cf8a0a2db0dddb151b0b3206079dcf2782834482a2c3b7.exe

    • Size

      684KB

    • MD5

      d3d46d0339ceb24c85568e75f78846a7

    • SHA1

      36f63066beba540453e1b93e6b1e282aed804234

    • SHA256

      26bd4a40d12d5483b5cf8a0a2db0dddb151b0b3206079dcf2782834482a2c3b7

    • SHA512

      d669aaafddb658f88dd6d325883d7b568b9e6b6dc5914b0d7d9d01cf468f0e0521e05e5a7f46e0437e9389470f4f5ec751b416b94412956c2a208b0bccc8227c

    • SSDEEP

      12288:vE1Gh9OfPNkHH1fl8Zjc38izOfdXacgGeOM0GejX6B:qM9ZZl4mGXjxeOMg4

    Score
    10/10
    djvudiscoverypersistenceransomware

    • Detected Djvu ransomware

    • Djvu Ransomware

      Ransomware which is a variant of the STOP family.

      ransomwaredjvu

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks