Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2956-0-0x0000000010000000-0x00000000104B5000-memory.dmp
-
Size
4.7MB
-
Sample
250310-wh1cbstjv3
-
MD5
03742d19843755bedacc445eaba82801
-
SHA1
af3860fcc43c056693af1e3a533b33ba408cb9f3
-
SHA256
269151290ec172daa999366dcaaf1a5719b7e40a40984821c2ff348ff1d60517
-
SHA512
5ac3afcf6fc84458a479b8146ba8690961235dca6f825495690c56c40076e892983b51905af1f5a8bc6093f408e10f01b20ae64591161549204f7303fcb643f2
-
SSDEEP
98304:acm3bMNI4j9HgcmhyOIFA/EeqDvzCkyqBwFwPD+8th5c:acm3ANIO9Hgc6oF6EeqD7Ckyqp
Behavioral task
behavioral1
Sample
2956-0-0x0000000010000000-0x00000000104B5000-memory.dll
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
2956-0-0x0000000010000000-0x00000000104B5000-memory.dll
Resource
win10v2004-20250217-en
Malware Config
Extracted
agenda
- Username:
[email protected] - Password:
agqpass
- Username:
[email protected] - Password:
agqpass
- Username:
[email protected] - Password:
12345
- Username:
[email protected] - Password:
690510
- Username:
[email protected] - Password:
agro2009admin
-
company_id
6ENLBw7FHl
-
note
-- Qilin Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from your system/network. Our group cooperates with the mass media. If you refuse to communicate with us and we do not come to an agreement, your data will be reviewed and published on our blog (http://kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion) and on the media page (https://31.41.244.100) Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials-- Credentials Extension: 6ENLBw7FHl Domain: 5xpitxvg6mas333qdoad3qfiv44o563sbgve4cpvey4qh3uv3aqfidyd.onion login: Qeg2YJErPVhPLm9w6o4eY99mfjndNqta password:
Targets
-
-
Target
2956-0-0x0000000010000000-0x00000000104B5000-memory.dmp
-
Size
4.7MB
-
MD5
03742d19843755bedacc445eaba82801
-
SHA1
af3860fcc43c056693af1e3a533b33ba408cb9f3
-
SHA256
269151290ec172daa999366dcaaf1a5719b7e40a40984821c2ff348ff1d60517
-
SHA512
5ac3afcf6fc84458a479b8146ba8690961235dca6f825495690c56c40076e892983b51905af1f5a8bc6093f408e10f01b20ae64591161549204f7303fcb643f2
-
SSDEEP
98304:acm3bMNI4j9HgcmhyOIFA/EeqDvzCkyqBwFwPD+8th5c:acm3ANIO9Hgc6oF6EeqD7Ckyqp
Score3/10 -