Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    5bd26a1b8b7c11a04ab63b6cdfc35424b332747c0a8a62432bff8268bd966ec5.exe

  • Size

    5.0MB

  • Sample

    250311-dvq1baypz3

  • MD5

    88630916b0c6633ca28c8896416a93ee

  • SHA1

    12c7a7465508e996e7b064ff8cfe983e38436194

  • SHA256

    5bd26a1b8b7c11a04ab63b6cdfc35424b332747c0a8a62432bff8268bd966ec5

  • SHA512

    06e25d164f6040f9889c844d458d5131605c3c9b26cf232bcced61f1f8ff9d49870345bf8495e7b203fec7eac3e56eeb82b01a0901b692c59ac16997a265be7e

  • SSDEEP

    98304:/n00lxSs02AeYFNzG+yd7DikB5Gi+/PHoUV:/00AenV5j+/PHN

Malware Config

Extracted

Family

agenda

Credentials
Attributes
  • company_id

    6ENLBw7FHl

  • note

    -- Qilin Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from your system/network. Our group cooperates with the mass media. If you refuse to communicate with us and we do not come to an agreement, your data will be reviewed and published on our blog (http://kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion) and on the media page (https://31.41.244.100) Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials-- Credentials Extension: 6ENLBw7FHl Domain: 5xpitxvg6mas333qdoad3qfiv44o563sbgve4cpvey4qh3uv3aqfidyd.onion login: Qeg2YJErPVhPLm9w6o4eY99mfjndNqta password:

rsa_pubkey.plain

Targets

    • Target

      5bd26a1b8b7c11a04ab63b6cdfc35424b332747c0a8a62432bff8268bd966ec5.exe

    • Size

      5.0MB

    • MD5

      88630916b0c6633ca28c8896416a93ee

    • SHA1

      12c7a7465508e996e7b064ff8cfe983e38436194

    • SHA256

      5bd26a1b8b7c11a04ab63b6cdfc35424b332747c0a8a62432bff8268bd966ec5

    • SHA512

      06e25d164f6040f9889c844d458d5131605c3c9b26cf232bcced61f1f8ff9d49870345bf8495e7b203fec7eac3e56eeb82b01a0901b692c59ac16997a265be7e

    • SSDEEP

      98304:/n00lxSs02AeYFNzG+yd7DikB5Gi+/PHoUV:/00AenV5j+/PHN

    • Agenda Ransomware

      A ransomware with multiple variants written in Golang and Rust first seen in August 2022.

    • Agenda family

MITRE ATT&CK Enterprise v15

Tasks