Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
RNSM00473.7z
-
Size
67.0MB
-
Sample
240925-jqepdawhjb
-
MD5
d5d5de530fbb720527c68dccdc430d74
-
SHA1
4dc21d744b484a6e27c3b9951826a1c21696266f
-
SHA256
083f1d249b006db1d48ae65b2be283b457cc3d91ff99727847425398eee698ea
-
SHA512
565d07e7060a435fdf6003ce94b32ef96fe5dd377a396c7c3a21a5f0af2a0c8bd36c618ac9342f76cece56c61ad23d1b8ed55a1390b5c8bf44b121b087cbebcc
-
SSDEEP
1572864:uLesVc87NdbYvuKYoh9a8KmH4XZDlvPE82nxVtR+q:uLK8NBYvuKho8KhXZZPE8kxnD
Malware Config
Targets
-
-
Target
RNSM00473.7z
-
Size
67.0MB
-
MD5
d5d5de530fbb720527c68dccdc430d74
-
SHA1
4dc21d744b484a6e27c3b9951826a1c21696266f
-
SHA256
083f1d249b006db1d48ae65b2be283b457cc3d91ff99727847425398eee698ea
-
SHA512
565d07e7060a435fdf6003ce94b32ef96fe5dd377a396c7c3a21a5f0af2a0c8bd36c618ac9342f76cece56c61ad23d1b8ed55a1390b5c8bf44b121b087cbebcc
-
SSDEEP
1572864:uLesVc87NdbYvuKYoh9a8KmH4XZDlvPE82nxVtR+q:uLK8NBYvuKho8KhXZZPE8kxnD
Score10/10-
Chaos
Ransomware family first seen in June 2021.
-
Chaos Ransomware
-
Detect MafiaWare666 ransomware
-
MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
-
VanillaRat
VanillaRat is an advanced remote administration tool coded in C#.
-
Renames multiple (93) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Vanilla Rat payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-