Overview

overview

10

Static

static

3

2026-07-26...na.exe

windows10-2004-x64

10

2026-07-26...na.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-07-26_1a1c445d27b67d413c4ac0eab361ea41_trigona
  • Size 615KB
  • Sample260726-24dcksem6v
  • SHA256 0ec88a0fcd5c4a2713bf48583cd3f5c5da080d52207a522d760af9670f6cc004
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
hunters_internationaldefense_evasionevasionexecutionimpactransomware

Malware Config

Extracted

Path

  • C:\$Recycle.Bin\how_to_decrypt.txt

  • hunters_international

Ransom Note
  • !!!ATTENTION to representatives ZUNI!!! Your confidential data is at risk!!! Your computer ID: ZUNI For more detailed information write to us: [email protected], [email protected] Telegram: https://t.me/BlackNevas Reserve Email: [email protected] [email protected] Dear ZUNI representatives! We are contacting you regarding an incident involving the security of your information systems. As a result of extensive and targeted monitoring of your network, we have gained access to your company's confidential data. Please note that collecting this volume of information is a lengthy process, and we have a complete understanding of your infrastructure, including its key vulnerabilities. Our areas of expertise: -File encryption (blocking access to critical data); -Industrial and economic espionage (handling confidential information). We emphasize that this incident has no personal motives. Our goal is not to harm or disrupt your business, but solely to collect ransom. We are not interested in the contents of your files; this is a standard commercial transaction for us. Current situation: Your confidential files have been copied and stored in our secure cloud storage. If you are not interested in resolving the situation, the data will be offered to interested parties (competitors, industry companies) through closed auctions or published publicly. Furthermore, without our participation, recovery of encrypted files will be impossible. Our offer: As part of the resolution process and as a gesture of goodwill, we are ready to analyze your network and provide comprehensive information on the vulnerabilities found that allowed this intrusion. This will help you strengthen your security in the future. Next steps: To resolve this situation with minimal losses for your company, we urge you to contact us as soon as possible. Delay or failure to respond to this notification is highly undesirable and will be considered a refusal to cooperate, which will entail the activation of the above measures. We look forward to hearing from you shortly. Warning about the consequences of unauthorized actions: - We inform you that any tampering with encrypted data on your part will have fatal consequences. - Destruction timer: After 7 days, decryption keys will be erased from our servers. This is an irreversible process. - Renaming: Even a minor change to a file name will break the encryption algorithm. Such files cannot be recovered. - Third-party tools: We guarantee that attempts to decrypt data using any third-party programs (including those claimed to be a "solution for your type of virus") will result in complete and permanent destruction of the data. Do not take any action until instructed by us. You are solely responsible for the safety of your files if you violate these terms. Get up-to-date customer information on our public blog without having to log in through Tor: https://www.ransomlook.io/screenshots/black%20nevas-ctyfftrjgtwdjzlgqh4avbd35sqrs6tde4oyam2ufbjch6oqpqtkdtidonion.png https://www.ransomware.live/group/blacknevas Your computer ID: ZUNI For more detailed information write to us: [email protected], [email protected] Telegram: https://t.me/BlackNevas ATTENTION to representatives ZUNI!!!! Ignoring or refusing to cooperate will force us to immediately transfer your confidential data to our partners. This will entail publication in specialized blogs about the leaks and its sale at closed auctions to interested parties. To open .onion sites you need to download the TOR browser https://www.torproject.org/download/ or the multifunctional browser Brave https://brave.com/download/ new private window Tor. Find your details on these sites of our partners: http://ctyfftrjgtwdjzlgqh4avbd35sqrs6tde4oyam2ufbjch6oqpqtkdtid.onion http://kill432ltnkqvaqntbalnsgojqqs2wz4lhnamrqjg66tq6fuvcztilyd.onion http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/ https://hunters55rdxciehoqzwv7vgyv6nt37tbwax2reroyzxhou7my5ejyid.onion/companies http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blog http://black3gnkizshuynieigw6ejgpblb53mpasftzd6pydqpmq2vn2xf6yd.onion http://embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onion http://k67ivvik3dikqi4gy4ua7xa6idijl4si7k5ad5lotbaeirfcsx4sgbid.onion Our Services / Affiliate Program: We're always available and open to any form of mutually beneficial cooperation. - For businesses (competitive intelligence): Need information on competitors? Let us know what data you need, and we'll do our best to obtain it as quickly as possible. We'll provide a full catalog of available assets for the company you're interested in. - For lawyers and victims: We partner with law firms and data breach victims. We'll provide comprehensive information about the company that was negligent and allowed its clients' data to be leaked for legal or other purposes. Please note! Many corporate email providers, as well as major email services like gmail.com and live.com, may block our messages. We recommend creating a ProtonMail account immediately. This is confidential and will ensure our messages reach us. Your computer ID: ZUNI For more detailed information write to us: [email protected], [email protected] Telegram: https://t.me/BlackNevas Reserve Email: [email protected] [email protected]
URLs

  • https://t.me/BlackNevas

  • https://www.ransomlook.io/screenshots/black%20nevas-ctyfftrjgtwdjzlgqh4avbd35sqrs6tde4oyam2ufbjch6oqpqtkdtidonion.png

  • https://www.ransomware.live/group/blacknevas

  • https://brave.com/download/

  • http://ctyfftrjgtwdjzlgqh4avbd35sqrs6tde4oyam2ufbjch6oqpqtkdtid.onion

  • http://kill432ltnkqvaqntbalnsgojqqs2wz4lhnamrqjg66tq6fuvcztilyd.onion

  • http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/

  • https://hunters55rdxciehoqzwv7vgyv6nt37tbwax2reroyzxhou7my5ejyid.onion/companies

  • http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blog

  • http://black3gnkizshuynieigw6ejgpblb53mpasftzd6pydqpmq2vn2xf6yd.onion

  • http://embargobe3n5okxyzqphpmk3moinoap2snz5k6765mvtkk7hhi544jid.onion

  • http://k67ivvik3dikqi4gy4ua7xa6idijl4si7k5ad5lotbaeirfcsx4sgbid.onion

Targets

    • Target
      2026-07-26_1a1c445d27b67d413c4ac0eab361ea41_trigona
    • Size 615KB
    • SHA256 0ec88a0fcd5c4a2713bf48583cd3f5c5da080d52207a522d760af9670f6cc004
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasionevasionexecutionhunters_internationalimpactransomware

    • Family: HuntersInternational, Water Ouroboros

      HuntersInternational aka Water Ouroboros is a ransomware that operates under a Ransomware-as-a-Service model.

      ransomwarehunters_international

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Deletes System State backups

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks