TrigonaMalware
According to PCrisk, Trigona is ransomware that encrypts files and appends the "._locked" extension to filenames. Also, it drops the "how_to_decrypt.hta" file that opens a ransom note. An example of how Trigona renames files: it renames "1.jpg" to "1.jpg._locked", "2.png" to "2.png._locked", and so forth.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io2 reports
ATT&CK techniques
6 of 8 · each with the sentence it comes from- T1003.001LSASS Memory
“…ames and passwords and also usernames and password hashes (T1550.002) which are usually retrieved by threat actors through LSASS Dump (T1003.001) during the intrusions.”
- T1053.005Scheduled Task
“In the following image, there can be seen two procedures: the first guides the threat actors to create a scheduled task to execute the ransomware in the Netlogon folder by using Windows cmd; whereas the second guides the threat actors to place the ransomware in the Netlogon folde…”
- T1059.003Windows Command Shell
“The attacker enabled xp_cmdshell parameters to allow SQL Server to spawn a Windows command shell and pass in a string for execution.”
- T1068Exploitation for Privilege Escalation
“The software requires a password to run and uses the vulnerable driver TfSysMon.sys (T1068) to terminate around 96 processes related to AV and EDR solutions.”
- T1110Brute Force
“Sekoia TDR observed an MS-SQL honeypot compromised by brute force within an hour, then used to deploy Mallox ransomware via PureCrypter.”
- T1490Inhibit System Recovery
“Mallox use bcedit to inhibit system recovery.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Mallox ransomware affiliate uses PureCrypter in MS-SQL attacks“…y corresponds to a CLR SqlShell malware, which has been documented by Asec in connection with the compromise of an MS-SQL server by the Trigona ransomware.”
-
Ransomware debris: an analysis of the RansomHub operation“….0 has a “Members” section with the aim of providing accounts for members of the affiliate group similar to features found on Qilin and Trigona’s platforms.”
Indicators in its reports
named in the reports above- hxxp://91.215.85[.]142/QWEwqdsvsf/ap.phpin 1 report
- 91.215.85[.]142in 1 report
- hxxps://whyers[.]ioin 1 report
- whyers[.]ioin 1 report
- hxxps://www.isxhost[.]uk/in 1 report
- www.isxhost[.]ukin 1 report
- operations[.]inin 1 report
Copy these 7 indicators · defanged
Thanks — we review every report.