Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
25/03/2025, 15:11
250325-skmbpsxzaw 1025/03/2025, 15:06
250325-sg1d6a1px2 1025/03/2025, 15:01
250325-sd5jpsxyct 1025/03/2025, 14:56
250325-sbdcfaxxgs 1025/03/2025, 14:50
250325-r7ve6a1nv3 1025/03/2025, 14:46
250325-r5ab7sxwhx 1025/03/2025, 14:40
250325-r2c9paxwe1 1005/02/2025, 10:25
250205-mgcefaslhw 1005/02/2025, 10:17
250205-mbs51atmbk 1005/02/2025, 09:15
250205-k785zs1pfn 10General
-
Target
RS.7z
-
Size
20.5MB
-
Sample
250325-skmbpsxzaw
-
MD5
2e40472330409ed96f91e8e0bb796eb4
-
SHA1
8fd90404184de1a627068a93482313449dbbec91
-
SHA256
c5741701b3866459dd1ffa2477cfd8776713612912693a5897f78aac795d23e9
-
SHA512
b11720cb8519fc6838161ba8bf696681b242b0789ffd5c442efbb50161d511fd65229ca88a347c856e8ff91501c077f5de7714b09e29d4400f595bfe7829189d
-
SSDEEP
393216:NkDF1XseDcJIrXeSG0b5mKZ1F0gvpdO8GPnqzHLP3iN5M0CptgNpAcklC0CN:GDjXseDcSra45mKt0gvT0PnMbzkNpAc/
Malware Config
Extracted
blackmatter
1.2
512478c08dada2af19e49808fbda5b0b
- Username:
[email protected] - Password:
120Heisler
- Username:
[email protected] - Password:
Tesla2019
- Username:
[email protected] - Password:
iteam8**
https://paymenthacks.com
http://paymenthacks.com
https://mojobiden.com
http://mojobiden.com
-
attempt_auth
true
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
true
-
mount_volumes
true
Extracted
mespinoza
-
ransomnote
Hi Company, Every byte on any types of your devices was encrypted. Don't try to use backups because it were encrypted too. To get all your data back contact us: [email protected] [email protected] [email protected] Also, be aware that we downloaded files from your servers and in case of non-payment we will be forced to upload them on our website, and if necessary, we will sell them on the darknet. Check out our website, we just posted there new updates for our partners: http://wqmfzni2nvbbpk25.onion/ -------------- FAQ: 1. Q: How can I make sure you don't fooling me? A: You can send us 2 files(max 2mb). 2. Q: What to do to get all data back? A: Don't restart the computer, don't move files and write us. 3. Q: What to tell my boss? A: Protect Your System Amigo.
Extracted
sodinokibi
$2a$10$kmb3nsvQXC.93GYNCGKy/uq9hYHivf0e3HcajFIifr8Hf3fmnofgm
7258
gasbarre.com
all-turtles.com
rksbusiness.com
christ-michael.net
mardenherefordshire-pc.gov.uk
erstatningsadvokaterne.dk
marchand-sloboda.com
unim.su
bauertree.com
faronics.com
moveonnews.com
autopfand24.de
mountsoul.de
beaconhealthsystem.org
cerebralforce.net
aprepol.com
kaotikkustomz.com
dubnew.com
simulatebrain.com
alvinschwartz.wordpress.com
-
net
true
-
pid
$2a$10$kmb3nsvQXC.93GYNCGKy/uq9hYHivf0e3HcajFIifr8Hf3fmnofgm
-
prc
outlook
agntsvc
infopath
sqbcoreservice
steam
firefox
ocomm
ocssd
mydesktopqos
oracle
powerpnt
wordpad
synctime
sql
thebat
onenote
excel
visio
encsvc
winword
mydesktopservice
dbsnmp
isqlplussvc
tbirdconfig
mspub
msaccess
thunderbird
ocautoupds
xfssvccon
dbeng50
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Data leak [+] First of all we have uploaded more then 70 GB archived data from your file server and SQL server Example of data: - Accounting - Finance - Personal Data - Banking data - Confidential files And more other... Our blog: http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion/ Read what happens to those who do not pay. We are ready: - To provide you the evidence of stolen data - To give you universal decrypting tool for all encrypted files. - To delete all the stolen data. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
7258
-
svc
svc$
vss
sophos
mepocs
backup
sql
memtas
veeam
Extracted
sodinokibi
$2a$10$dfjpLrXuDytfF.kmYtQ1ROgsXjTJEe8EmQT65ftxlTpJtXPZrhsAq
7178
kamahouse.net
bridgeloanslenders.com
abitur-undwieweiter.de
live-your-life.jp
xn--rumung-bua.online
anteniti.com
marcuswhitten.site
ostheimer.at
joseconstela.com
deepsouthclothingcompany.com
dr-seleznev.com
ecpmedia.vn
aunexis.ch
anthonystreetrimming.com
pocket-opera.de
mooreslawngarden.com
osterberg.fi
extraordinaryoutdoors.com
kamienny-dywan24.pl
fitovitaforum.com
-
net
false
-
pid
$2a$10$dfjpLrXuDytfF.kmYtQ1ROgsXjTJEe8EmQT65ftxlTpJtXPZrhsAq
-
prc
avgadmsv
BackupUpdater
ocautoupds
synctime
thebat
excel
isqlplussvc
ccSetMgr
SPBBCSvc
Sage.NA.AT_AU.SysTray
lmibackupvssservice
CarboniteUI
powerpnt
BackupMaint
onenote
klnagent
sql
Rtvscan
xfssvccon
Smc
mspub
encsvc
LogmeInBackupService
kavfsscs
ccSvcHst
BackupExtender
NSCTOP
outlook
dbsnmp
mydesktopservice
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Attention!!! [+] Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
7178
-
svc
ssistelemetry
adsync
svc$
msseces
mbamservice
ssastelemetry
altaro
sbamsvc
ds_notifier
ntrtscan
ofcservice
code42service
macmnsvc
memtas
auservice
telemetryserver
tmccsf
psqlwge
sppsvc
viprepplsvc
azurea
ds_monitor
swi_filter
protectedstorage
mfemms
mfevtp
kaseyaagentendpoint
ltservice
dssvc
altiback
Targets
-
-
Target
out.upx
-
Size
59KB
-
MD5
e685142e6a7aa02d184bd33ea1e38365
-
SHA1
e6d8ff6eb9f040346de1d085b7138513baff4406
-
SHA256
adfd80323fa60aab36f3217f37580b462168bc414e65deebd5b2609d22b826a2
-
SHA512
55d0790f1c4fffb28f68a33f016fab2e6092602c746e8c918d91f98005f3c473ced73a30841e3a951c47f8c7de73f3050c8af16146665e9d8ec955830320aec6
-
SSDEEP
768:DTjagICPhDt3bS4nyzRCuwSbV5dNcxGV1ylQ+Ix:RpDtG4nMEboDTV1ylnI
Score3/10 -
-
-
Target
out.upx
-
Size
40KB
-
MD5
1dc19cb4abfbdfce5b34756603fb5d43
-
SHA1
8b2d7f82fc13888bf0fa97c1fe73ae8eb615b703
-
SHA256
c1bac7436253ca3e66f36dfdbc1f237cf4c6bc0cf7f2dec5dd9ed9611d16191f
-
SHA512
394dc2752498ebea6ae44172e337f764034fd78187b79d5a8c1c525811802c04b20edb9a885aecc4f6e417e250ca42b08993774fee40986e1eb3209a05ce8e5d
-
SSDEEP
384:moyzEpcGhIxJl9JEdauBNa/nu333s8JrxRMt0GNtslmlLpB1pyLloyGw6Bm7lpIn:mo4EpThIpEdauX3hS/sjfkGudUj9Vg
Score3/10 -
-
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
fccff8cb7a1067e23fd2e2b63971a8e1
-
SHA1
30e2a9e137c1223a78a0f7b0bf96a1c361976d91
-
SHA256
6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
-
SHA512
f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
-
SSDEEP
192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
Score1/10 -
-
-
Target
779389082
-
Size
56KB
-
MD5
40b7f298d30296864906d4e175ff9f43
-
SHA1
349b60915d0ce78aacc57231ae1e0df151e20087
-
SHA256
2448a49c12e2c959a2f88d179c346a4d753725578a4755c8f8f487b1048fdcd4
-
SHA512
ed4c76fa8e4e0eb527f34ea6a25094ee8bdc343be1c0806bcb8baff3cd77e6944cee50125090a7fd8869951b53ced7dce4a48a197859a1e4616c7495390b36e7
-
SSDEEP
1536:+zrP8O1uZc8rX0UvvhfU7hq1whmhOh/mgNekb6Z:+zL8O1oc8rEUvZfq3hS4zi
Score1/10 -
-
-
Target
out.upx
-
Size
376KB
-
MD5
79994194688c2a3f77e740450b05bb54
-
SHA1
98d4f00086ae1a5aa21d27f20bd2e9a0c6f7a0c3
-
SHA256
0e91b27341728082ebaa8765c96c769d2477b386d1c10c5757d0751a4ff39357
-
SHA512
f8a95c793ffb59388af66e30a1c2b9cf1a6e6f5740d64aed490458f3821d1d2ab5af1c89707c49317bd3851ff5ad4dafa8bdc1f714b0a4f04c5cf0a296216c78
-
SSDEEP
6144:6ONNYdX7HkqEHcyY6uoZzFyKAuGnlOOkl8tuGogbOIVB9J4:6ONNoX7HMHcyY6uoZzFyfONlwNBo
Score3/10 -