Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    43691290ac03ebb26754203f1cc3940b32f036babb7cfab3cb14fe2128389c0c.exe

  • Size

    5.0MB

  • Sample

    250311-df8a2syzc1

  • MD5

    2bb209ccfc5103eccab523c875050cfa

  • SHA1

    c5b2e36ef6356757da4bbce417ca90f49d369526

  • SHA256

    43691290ac03ebb26754203f1cc3940b32f036babb7cfab3cb14fe2128389c0c

  • SHA512

    7e6701343e4b46c9faa8af7b81a4a61c0b12651e47b2f2c9c0ddbf62663147c53bcc8295ef3249e08ee7ab62f8d29951b3f2fad3f775eb580eac14c3b9f21c9c

  • SSDEEP

    98304:usBHJmM4GxhB9KK2yngd2ndMdudGfcwJhIUYbimDtMt/nTWh1:usBHJmM4GXyyngCbBtMt/

Malware Config

Extracted

Family

agenda

Attributes
  • company_id

    0c-IyC4m1G

  • note

    -- Qilin Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from your system/network. Our group cooperates with the mass media. If you refuse to communicate with us and we do not come to an agreement, your data will be reviewed and published on our blog and on the media page (https://31.41.244.100) Blog links: http://kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials-- Credentials Extension: 0c-IyC4m1G Domain: fsthixb5w4uq3nge4xrghmvxnufnd77vvic7mxvrgkjycrpyy6fw5qad.onion login: cRKOId7XfmSWmvHze5tj-66-LKhnooRT password:

rsa_pubkey.plain

Targets

    • Target

      43691290ac03ebb26754203f1cc3940b32f036babb7cfab3cb14fe2128389c0c.exe

    • Size

      5.0MB

    • MD5

      2bb209ccfc5103eccab523c875050cfa

    • SHA1

      c5b2e36ef6356757da4bbce417ca90f49d369526

    • SHA256

      43691290ac03ebb26754203f1cc3940b32f036babb7cfab3cb14fe2128389c0c

    • SHA512

      7e6701343e4b46c9faa8af7b81a4a61c0b12651e47b2f2c9c0ddbf62663147c53bcc8295ef3249e08ee7ab62f8d29951b3f2fad3f775eb580eac14c3b9f21c9c

    • SSDEEP

      98304:usBHJmM4GxhB9KK2yngd2ndMdudGfcwJhIUYbimDtMt/nTWh1:usBHJmM4GXyyngCbBtMt/

    • Agenda Ransomware

      A ransomware with multiple variants written in Golang and Rust first seen in August 2022.

    • Agenda family

MITRE ATT&CK Enterprise v15

Tasks