Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Ransomware.RedBoot.zip
-
Size
1.2MB
-
Sample
240808-hkmbla1aqp
-
MD5
51250dabf7df7832640e4a680676cb46
-
SHA1
74ba41bb17af6e5638171f7a6d9d49e978d8d3b3
-
SHA256
7fa2bf61405ac573a21334e34bf713dcb5d1fc0c72674e6cebc48d33a4a14d44
-
SHA512
43f898d7e5752312a79138dcce94c117a20fb6efd9e522fc1ed3cc2d407d13cacf5b6f810c7c1966c4c03217aeb51fce641feb31b26620ff239756132b17f57a
-
SSDEEP
24576:X55snqlV0L1X93CIhhFrJK/Hw75gIiaC+4llRCIPY7tdyPHno51SCUR:J53lV0LX5hFrswyVFlMEYSnCw
Behavioral task
behavioral1
Sample
1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887
-
Size
1.2MB
-
MD5
e0340f456f76993fc047bc715dfdae6a
-
SHA1
d47f6f7e553c4bc44a2fe88c2054de901390b2d7
-
SHA256
1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887
-
SHA512
cac10c675d81630eefca49b2ac4cc83f3eb29115ee28a560db4d6c33f70bf24980e48bb48ce20375349736e3e6b23a1ca504b9367917328853fffc5539626bbc
-
SSDEEP
24576:/4GHnhIzOasqUgEOr69/BRH7dCibu+XoAX0eOTva49ttrSpt81ekHPyWe:AshdasJgEOrGBRxCihH7OO49rveMG
Score9/10-
Renames multiple (189) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE
-
Loads dropped DLL
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-