Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

TrojanRans...29.exe

windows10-1703-x64

10

source/Bat...er.exe

windows10-1703-x64

7

source/Bat...lp.chm

windows10-1703-x64

1

source/Cov29Cry.exe

windows10-1703-x64

10

source/Cov...v4.exe

windows10-1703-x64

10

source/Cov...ry.exe

windows10-1703-x64

10

source/Cov...en.exe

windows10-1703-x64

3

source/Cov...en.exe

windows10-1703-x64

3

source/Tro...29.bat

windows10-1703-x64

10

source/mbr.exe

windows10-1703-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Covid29 Ransomware.zip

  • Size

    1.7MB

  • MD5

    272d3e458250acd2ea839eb24b427ce5

  • SHA1

    fae7194da5c969f2d8220ed9250aa1de7bf56609

  • SHA256

    bbb5c6b4f85c81a323d11d34629776e99ca40e983c5ce0d0a3d540addb1c2fe3

  • SHA512

    d05bb280775515b6eedf717f88d63ed11edbaae01321ec593ecc0725b348e9a0caacf7ebcd2c25a6e0dc79b2cdae127df5aa380b48480332a6f5cd2b32d4e55c

  • SSDEEP

    49152:dSrGy+kXRl9cIXjRG8OzbgFSXACZ4UL238tvVZkKNDN0AaFlkUSan:OZlyIzRXOfZv4UrtvVZRW6i

Score
10/10
upxchaos

Malware Config

Signatures

  • Chaos Ransomware 3 IoCs
  • Chaos family
    chaos
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

Files

  • Covid29 Ransomware.zip
    .zip
  • TrojanRansomCovid29.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • readme.txt
  • source/Bat To Exe Converter/Bat_To_Exe_Converter.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • source/Bat To Exe Converter/help.chm
    .chm
  • source/Bat To Exe Converter/settings.ini
  • source/Cov29Cry.exe.death
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • source/Cov29Cry/AdvancedOptions.PNG
    .png
  • source/Cov29Cry/Chaos Ransomware Builder v4.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • source/Cov29Cry/Cov29Cry.exe.death
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • source/Cov29Cry/FileExtentions.txt
  • source/Cov29Cry/Options.PNG
    .png
  • source/Cov29Cry/bg.jpg
    .jpg
  • source/Cov29Cry/covid29-is-here.txt
  • source/Cov29LockScreen.exe
    .exe windows:4 windows x86 arch:x86

    2cdb5118ade9e194fb3c02df82290ccf


    Headers

    Imports

    Sections

  • source/Cov29LockScreen/23311_lores.jpg
    .jpg
  • source/Cov29LockScreen/Cov29LockScreen.exe
    .exe windows:4 windows x86 arch:x86

    2cdb5118ade9e194fb3c02df82290ccf


    Headers

    Imports

    Sections

  • source/Cov29LockScreen/Cov29LockScreen.vbp
  • source/Cov29LockScreen/Cov29LockScreen.vbw
  • source/Cov29LockScreen/Form1.frm
  • source/Cov29LockScreen/Form1.frx
  • source/TrojanRansomCovid29.bat
  • source/icon.ico
  • source/icon.jfif
    .jpg
  • source/mbr.cpp
  • source/mbr.exe.danger
    .exe windows:4 windows x86 arch:x86

    0341b2251534bec6e436b281a0639ffe


    Headers

    Imports

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.