Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
43691290ac03ebb26754203f1cc3940b32f036babb7cfab3cb14fe2128389c0c.exe
-
Size
5.0MB
-
Sample
250310-t5fkbs1nw5
-
MD5
2bb209ccfc5103eccab523c875050cfa
-
SHA1
c5b2e36ef6356757da4bbce417ca90f49d369526
-
SHA256
43691290ac03ebb26754203f1cc3940b32f036babb7cfab3cb14fe2128389c0c
-
SHA512
7e6701343e4b46c9faa8af7b81a4a61c0b12651e47b2f2c9c0ddbf62663147c53bcc8295ef3249e08ee7ab62f8d29951b3f2fad3f775eb580eac14c3b9f21c9c
-
SSDEEP
98304:usBHJmM4GxhB9KK2yngd2ndMdudGfcwJhIUYbimDtMt/nTWh1:usBHJmM4GXyyngCbBtMt/
Static task
static1
Behavioral task
behavioral1
Sample
43691290ac03ebb26754203f1cc3940b32f036babb7cfab3cb14fe2128389c0c.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
43691290ac03ebb26754203f1cc3940b32f036babb7cfab3cb14fe2128389c0c.exe
Resource
win10v2004-20250217-en
Malware Config
Extracted
agenda
-
company_id
0c-IyC4m1G
-
note
-- Qilin Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from your system/network. Our group cooperates with the mass media. If you refuse to communicate with us and we do not come to an agreement, your data will be reviewed and published on our blog and on the media page (https://31.41.244.100) Blog links: http://kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials-- Credentials Extension: 0c-IyC4m1G Domain: fsthixb5w4uq3nge4xrghmvxnufnd77vvic7mxvrgkjycrpyy6fw5qad.onion login: cRKOId7XfmSWmvHze5tj-66-LKhnooRT password:
Targets
-
-
Target
43691290ac03ebb26754203f1cc3940b32f036babb7cfab3cb14fe2128389c0c.exe
-
Size
5.0MB
-
MD5
2bb209ccfc5103eccab523c875050cfa
-
SHA1
c5b2e36ef6356757da4bbce417ca90f49d369526
-
SHA256
43691290ac03ebb26754203f1cc3940b32f036babb7cfab3cb14fe2128389c0c
-
SHA512
7e6701343e4b46c9faa8af7b81a4a61c0b12651e47b2f2c9c0ddbf62663147c53bcc8295ef3249e08ee7ab62f8d29951b3f2fad3f775eb580eac14c3b9f21c9c
-
SSDEEP
98304:usBHJmM4GxhB9KK2yngd2ndMdudGfcwJhIUYbimDtMt/nTWh1:usBHJmM4GXyyngCbBtMt/
Score10/10-
Agenda Ransomware
A ransomware with multiple variants written in Golang and Rust first seen in August 2022.
-
Agenda family
-