Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2025-03-21_6cc3475b50469100df7c24810d48b89f_darkgate_luca-stealer_ryuk
-
Size
30.6MB
-
Sample
250321-jz9acavxat
-
MD5
6cc3475b50469100df7c24810d48b89f
-
SHA1
968829575a378d4d91af615db5e0f7e1db692694
-
SHA256
14356a2680d913a3e37991e9d7755d86a7c0c6203917c34b0ea422491f3b28ed
-
SHA512
54352b933f2c8b9fa44fb395c37ac72a54298068e55c9828f03172117bb9bb084e43e01522270876ed39f5d7b166641a74e3ce3035ef4ccda8e77ead8143db98
-
SSDEEP
98304:9E2RpMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMYJMMzMf:9nwngnwnBRRRVRO
Malware Config
Targets
-
-
Target
2025-03-21_6cc3475b50469100df7c24810d48b89f_darkgate_luca-stealer_ryuk
-
Size
30.6MB
-
MD5
6cc3475b50469100df7c24810d48b89f
-
SHA1
968829575a378d4d91af615db5e0f7e1db692694
-
SHA256
14356a2680d913a3e37991e9d7755d86a7c0c6203917c34b0ea422491f3b28ed
-
SHA512
54352b933f2c8b9fa44fb395c37ac72a54298068e55c9828f03172117bb9bb084e43e01522270876ed39f5d7b166641a74e3ce3035ef4ccda8e77ead8143db98
-
SSDEEP
98304:9E2RpMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMYJMMzMf:9nwngnwnBRRRVRO
Score10/10-
Modifies WinLogon for persistence
-
Renames multiple (91) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-