Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2420-0-0x0000000010000000-0x00000000104B5000-memory.dmp
-
Size
4.7MB
-
Sample
250310-wkjscstwaw
-
MD5
f588802958c35fe18eb87bc36651a3d1
-
SHA1
45fb5e8c7b4809abab0d7b64875490dc6afa2fef
-
SHA256
dcce9e235d247c1c368a85edc1480d8a5d8ba07413a222161bfc52632d6f0762
-
SHA512
aae5f7b82c3326f8a439e2b8ce72c7d69ee06da73b1c0b7a426e9a94bd3a4ca78e83c1b6eededbcf2564f1ab78f74b92e4e3d0e449f7c334a3257d188488c639
-
SSDEEP
98304:qTAroKRRlaL3IkcusxIViubeqDVzCkyLEKFwPD+8th5L:qTArpRRoL3IknLVVbeqDNCkyLm
Behavioral task
behavioral1
Sample
2420-0-0x0000000010000000-0x00000000104B5000-memory.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2420-0-0x0000000010000000-0x00000000104B5000-memory.dll
Resource
win10v2004-20250217-en
Malware Config
Extracted
agenda
-
company_id
0c-IyC4m1G
-
note
-- Qilin Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from your system/network. Our group cooperates with the mass media. If you refuse to communicate with us and we do not come to an agreement, your data will be reviewed and published on our blog and on the media page (https://31.41.244.100) Blog links: http://kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials-- Credentials Extension: 0c-IyC4m1G Domain: fsthixb5w4uq3nge4xrghmvxnufnd77vvic7mxvrgkjycrpyy6fw5qad.onion login: cRKOId7XfmSWmvHze5tj-66-LKhnooRT password:
Targets
-
-
Target
2420-0-0x0000000010000000-0x00000000104B5000-memory.dmp
-
Size
4.7MB
-
MD5
f588802958c35fe18eb87bc36651a3d1
-
SHA1
45fb5e8c7b4809abab0d7b64875490dc6afa2fef
-
SHA256
dcce9e235d247c1c368a85edc1480d8a5d8ba07413a222161bfc52632d6f0762
-
SHA512
aae5f7b82c3326f8a439e2b8ce72c7d69ee06da73b1c0b7a426e9a94bd3a4ca78e83c1b6eededbcf2564f1ab78f74b92e4e3d0e449f7c334a3257d188488c639
-
SSDEEP
98304:qTAroKRRlaL3IkcusxIViubeqDVzCkyLEKFwPD+8th5L:qTArpRRoL3IknLVVbeqDNCkyLm
Score3/10 -