Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

Trojan.Ransom.exe

windows7-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Trojan.Ransom.BadRabbit.zip

  • Size

    394KB

  • Sample

    250318-pv1ejasygy

  • MD5

    8e7023ae7f715e8b52c08a84a8a928d0

  • SHA1

    485cd098dc7528125fc1afe3510934ffa38a6763

  • SHA256

    8d4d683caf6146c7b80d9902cf98f4f620e423a55929335b96b12c5ad745880b

  • SHA512

    720122f37f39e70c31ccd77d2fd8a2c00f64d50e8ba3f9d1d0aa3e83215a02a86a95e1ca64577af4147d96950a6bbed36f815950e36a4ef2dafb5a56ce8bb16e

  • SSDEEP

    12288:Nc9QwLbqMRKHZ2fEr9ZJOZ0kasGObXd4f3:qbqMRwZuErVOFmObXd4f

Score
10/10
badrabbitmimikatzdiscoveryransomware

Malware Config

Targets

    • Target

      Trojan.Ransom.BadRabbit

    • Size

      431KB

    • MD5

      fbbdc39af1139aebba4da004475e8839

    • SHA1

      de5c8d858e6e41da715dca1c019df0bfb92d32c0

    • SHA256

      630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

    • SHA512

      74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

    • SSDEEP

      12288:BHNTywFAvN86pLbqWRKHZKfErrZJyZ0yqsGO3XR63:vT56NbqWRwZaEr3yt2O3XR63

    Score
    10/10
    badrabbitmimikatzdiscoveryransomware

    • BadRabbit

      Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.

      ransomwarebadrabbit

    • Badrabbit family

      badrabbit

    • Mimikatz

      mimikatz is an open source tool to dump credentials on Windows.

      mimikatz

    • Mimikatz family

      mimikatz

    • mimikatz is an open source tool to dump credentials on Windows

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks