Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
5bd26a1b8b7c11a04ab63b6cdfc35424b332747c0a8a62432bff8268bd966ec5.exe
-
Size
5.0MB
-
Sample
250311-dvq1baypz3
-
MD5
88630916b0c6633ca28c8896416a93ee
-
SHA1
12c7a7465508e996e7b064ff8cfe983e38436194
-
SHA256
5bd26a1b8b7c11a04ab63b6cdfc35424b332747c0a8a62432bff8268bd966ec5
-
SHA512
06e25d164f6040f9889c844d458d5131605c3c9b26cf232bcced61f1f8ff9d49870345bf8495e7b203fec7eac3e56eeb82b01a0901b692c59ac16997a265be7e
-
SSDEEP
98304:/n00lxSs02AeYFNzG+yd7DikB5Gi+/PHoUV:/00AenV5j+/PHN
Static task
static1
Behavioral task
behavioral1
Sample
5bd26a1b8b7c11a04ab63b6cdfc35424b332747c0a8a62432bff8268bd966ec5.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5bd26a1b8b7c11a04ab63b6cdfc35424b332747c0a8a62432bff8268bd966ec5.exe
Resource
win10v2004-20250217-en
Malware Config
Extracted
agenda
- Username:
[email protected] - Password:
agqpass
- Username:
[email protected] - Password:
agqpass
- Username:
[email protected] - Password:
12345
- Username:
[email protected] - Password:
690510
- Username:
[email protected] - Password:
agro2009admin
-
company_id
6ENLBw7FHl
-
note
-- Qilin Your network/system was encrypted. Encrypted files have new extension. -- Compromising and sensitive data We have downloaded compromising and sensitive data from your system/network. Our group cooperates with the mass media. If you refuse to communicate with us and we do not come to an agreement, your data will be reviewed and published on our blog (http://kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion) and on the media page (https://31.41.244.100) Data includes: - Employees personal data, CVs, DL , SSN. - Complete network map including credentials for local and remote services. - Financial information including clients data, bills, budgets, annual reports, bank statements. - Complete datagrams/schemas/drawings for manufacturing in solidworks format - And more... -- Warning 1) If you modify files - our decrypt software won't able to recover data 2) If you use third party software - you can damage/modify files (see item 1) 3) You need cipher key / our decrypt software to restore you files. 4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions. -- Recovery 1) Download tor browser: https://www.torproject.org/download/ 2) Go to domain 3) Enter credentials-- Credentials Extension: 6ENLBw7FHl Domain: 5xpitxvg6mas333qdoad3qfiv44o563sbgve4cpvey4qh3uv3aqfidyd.onion login: Qeg2YJErPVhPLm9w6o4eY99mfjndNqta password:
Targets
-
-
Target
5bd26a1b8b7c11a04ab63b6cdfc35424b332747c0a8a62432bff8268bd966ec5.exe
-
Size
5.0MB
-
MD5
88630916b0c6633ca28c8896416a93ee
-
SHA1
12c7a7465508e996e7b064ff8cfe983e38436194
-
SHA256
5bd26a1b8b7c11a04ab63b6cdfc35424b332747c0a8a62432bff8268bd966ec5
-
SHA512
06e25d164f6040f9889c844d458d5131605c3c9b26cf232bcced61f1f8ff9d49870345bf8495e7b203fec7eac3e56eeb82b01a0901b692c59ac16997a265be7e
-
SSDEEP
98304:/n00lxSs02AeYFNzG+yd7DikB5Gi+/PHoUV:/00AenV5j+/PHN
Score10/10-
Agenda Ransomware
A ransomware with multiple variants written in Golang and Rust first seen in August 2022.
-
Agenda family
-