Ransomware.live: trigona

According to PCrisk, Trigona is ransomware that encrypts files and appends the ._locked extension to filenames. Also, it drops the how_to_decrypt.hta file that opens a ransom note. An example of how Trigona renames files: it renames 1.jpg to 1.jpg._locked, 2.png to 2.png._locked, and so forth.It embeds the encrypted decryption key, the campaign ID, and the victim ID in the encrypted files.

Victims

First Discovered

2023-04-17

victim

Last Discovered

2024-03-30

victim

Inactive Since

2yrs

more than

Avg Delay

10.2

days

Infostealer

43.3%

victims with domain

Countries

hit

View Victims on World Map View Group Statistics

Known Locations (4)

Title	Available	Last Visit	FQDN
Trigona is Gone	No	2026-04-28T07:22:00	`3x55o3u2b7cjs54eifja5m3ottxntlubhjzt6k6htp5nrocjmsxxh7ad.onion`
Blog	No	2026-04-28T07:24:32	`6n5tfadusp4sarzuxntz34q4ohspiaya2mc6aw6uhlusfqfsdomavyyd.onion`
Trigona is Gone	No	2026-04-28T07:27:05	`trigonax2zb3fw34rbaap4cqep76zofxs53zakrdgcxzq6xzt24l5lqd.onion`
Blog	No	2026-04-28T07:29:37	`krsbhaxbki6jr4zvwblvkaqzjkircj7cxf46qt3na5o5sj2hpikbupqd.onion`

Target

Heatmap

Ransom Notes (1)

Tools Used

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
Advanced Port Scanner SoftPerfect NetScan placeholder placeholder placeholder	AnyDesk LogMeIn ScreenConnect Splashtop TeamViewer	placeholder placeholder placeholder placeholder placeholder	Mimikatz placeholder placeholder placeholder placeholder	Cobalt Strike placeholder placeholder placeholder placeholder	placeholder placeholder placeholder placeholder placeholder	placeholder placeholder placeholder placeholder placeholder	MEGA RClone placeholder placeholder placeholder

YARA Rules (1)

Indicators of Compromise (IoCs) (115)

Email 1 Hash MD5 114

Type	IOC
`Email`	`farusbig@tutanota.com`
`Hash MD5`	`00380c75734fd72885b315c53b4e9774`
`Hash MD5`	`0161027a354f9a1fc8e605261400fba9`
`Hash MD5`	`018d410685c743dedaad1dff81486dd7`
`Hash MD5`	`03ab9195dcbd96fbe4e11917c50b57b6`
`Hash MD5`	`03eaabaf750bcf69d58f79098432f8a3`
`Hash MD5`	`0452d8379cae3490935f81a0dfea1a9e`
`Hash MD5`	`07a155371aded5527e7bf38bf6445537`
`Hash MD5`	`0999410905d53bcb9e4bf5ae113330f4`
`Hash MD5`	`0d928467bf7d0226f95eed9af9f2e650`
`Hash MD5`	`10403f08a869a83d5c8d81162b711453`
`Hash MD5`	`12a0a4fad23eb3b9ee6a4e7baa6fa880`
`Hash MD5`	`145d3ae9d1c6f1d4aa67e31fa32c32e9`
`Hash MD5`	`155569b791e9a12e68c173170ea84ea8`
`Hash MD5`	`15d05dfa5cff0cfc86e5135155744385`
`Hash MD5`	`1852be15aa8dcf664291b3849bd348e4`
`Hash MD5`	`1a86cd5437ab93e78a95683df51ad525`
`Hash MD5`	`1d5622cc9901830f76672bff670ff565`
`Hash MD5`	`1da7262950658cbf6557d996658aecd6`
`Hash MD5`	`1f2e30361154ecc055bfe96e22bbef20`
`Hash MD5`	`21477e62d5ddebf6fcb1ecb8002d0c8c`
`Hash MD5`	`2506fe932b2e3acf792f2582d0c302db`
`Hash MD5`	`27c7b397960d96a974a704b7f24dd8a8`
`Hash MD5`	`2814a6b44c5c102032dd566408f99124`
`Hash MD5`	`2c31a750240788f924ef64a2fb4fdf3b`
`Hash MD5`	`2c83e59eea3e6890d31adc7c518e3702`
`Hash MD5`	`2d0973538cb4ae6347ad592e64cea59f`
`Hash MD5`	`344c3f60bdccc98812b0dc5f9dc2f413`
`Hash MD5`	`3637a397b30237dfdef72a21eb542d33`
`Hash MD5`	`36a52cda091a0d5b20a567f0015308b4`
`Hash MD5`	`396460e7459be6a8b1f7350de4c8d752`
`Hash MD5`	`399bcaf347b3c9a024f1cd63cc62b193`
`Hash MD5`	`39fac17fb009f7995348e9265ca983a9`
`Hash MD5`	`42301ee7b3dec6b09c5b693a212242d9`
`Hash MD5`	`44cda3592e15092bf5e2312f91e231d0`
`Hash MD5`	`4851e59fa347df21ab856397b98f5490`
`Hash MD5`	`4a0d2acb96b8a5b95ae8175ecb560c4f`
`Hash MD5`	`4becb7b02f39cfe4af8031a6f0464282`
`Hash MD5`	`4c282ce56a6991de050c2d8ea93d2b77`
`Hash MD5`	`4eb6c2e3ff883a49b7709f97bfdf7079`
`Hash MD5`	`4f287c6c35f36203168b9d02ac8da88a`
`Hash MD5`	`4fae00c0278abb3156d6e48c4af42b37`
`Hash MD5`	`51c6124113221d1bf27e21c6fbbd1a97`
`Hash MD5`	`538c61b8d943a62f5978ac69e44f9c11`
`Hash MD5`	`53d89e90a54fef428f74eed41b14fb38`
`Hash MD5`	`56e4b76555c94000cb21a7571dae2715`
`Hash MD5`	`5833bc744e0687e57be590e2685bddef`
`Hash MD5`	`5c1ef3e67167dc9d4ad2af212f59fd4c`
`Hash MD5`	`5f3407dedd4b9bf1e57209cc2178b8dc`
`Hash MD5`	`60fff4ae1f1007ec4f34a20af1255d68`
`Hash MD5`	`6358d925c5393bf4f6347369c88a1280`
`Hash MD5`	`66cd0ea0fbcecd96016782a63753c335`
`Hash MD5`	`68635ad9d12f683071611bfd34c1ec34`
`Hash MD5`	`6ae62456341ad1a113597a50779c095a`
`Hash MD5`	`6cb8c1ca706d9d6b1afb3c3a0872f70a`
`Hash MD5`	`6f059281f864368d16c5bf49cafa9c51`
`Hash MD5`	`71ff62df6b65bbdb6144acc2fbb516ca`
`Hash MD5`	`72c38f2bb567386f71c4517638dbcb8f`
`Hash MD5`	`75acf47d1c2ff932b1b2b61e17424826`
`Hash MD5`	`7b2d0d3fc3ddbc01f042c5c72506ef0a`
`Hash MD5`	`7c870d186057084254075870aebfb111`
`Hash MD5`	`7f07488381c1fc7c09215d6f77601fb6`
`Hash MD5`	`7f7c78fb5d9fdee28996a3f12bd00fef`
`Hash MD5`	`8061b9de6bbc0eadbc4000120678c544`
`Hash MD5`	`82c4867ee2bd7460e36c38528cf8a6a4`
`Hash MD5`	`846fc21208bba21d72f5bbabe3a4148a`
`Hash MD5`	`8a4a51a2175b0935a5172536e6d27054`
`Hash MD5`	`8a61e38f6bb7a87ce40ce9c987dc4ce6`
`Hash MD5`	`8b36239feabd0cf0fb526f94c411f67a`
`Hash MD5`	`8e2965a4dd7a27ed1b304ac03ad4d728`
`Hash MD5`	`8f75b0c895b1854566ebe2ec592c6fa6`
`Hash MD5`	`91803d9a3674d6739a60f51a9fbc8f32`
`Hash MD5`	`927c94b401a7711cf5f6c910d9c46f52`
`Hash MD5`	`93472c81a0f33a18fa8f88c8b2814356`
`Hash MD5`	`94cf899790945aca27e8bd195b86ecd6`
`Hash MD5`	`9734089f6eab3bf3d443755954cc785f`
`Hash MD5`	`97f9d8c8d44da37c7b9cefe31bda3466`
`Hash MD5`	`997d9e2d14080c5d176b6bb414d88561`
`Hash MD5`	`9bce9dae679419198574f4c9837085db`
`Hash MD5`	`9e5e96c4318ea5e8daab17ea456af069`
`Hash MD5`	`a4ccd1a3ee084e7356cffb3e0a41eab1`
`Hash MD5`	`aa0406ac91d3a12e57f52ef82cb7d2e7`
`Hash MD5`	`ade360987f5cca7d29e9de4b8fd8fe53`
`Hash MD5`	`b2207b0c5793df85dd216dfbf9c2315d`
`Hash MD5`	`b230c3f70c8f30c17279452b353dc5ba`
`Hash MD5`	`b4af619cdc21b9947f7ae58cb73e9175`
`Hash MD5`	`b521ee7d7e2089ab5c68debbb319ca91`
`Hash MD5`	`b59a9174ff768633e2cf5dfb16e516a8`
`Hash MD5`	`b7271756136f8f07923acae4e64f8efa`
`Hash MD5`	`c28b33f7365f9dc72cc291d13458f334`
`Hash MD5`	`c62620dc472f8e2835ad3abc6acd6e35`
`Hash MD5`	`c68f8ee17c3e4e0c4ab82631c5df30fc`
`Hash MD5`	`c6c511ba966328c9497c8aa9264fb733`
`Hash MD5`	`ca2200de13490701a70a3193565bc691`
`Hash MD5`	`ca33f9d7566d3578129c352bd5a93597`
`Hash MD5`	`cdb36dc4612f1ccc231fe54d8a3543d3`
`Hash MD5`	`d0291a6d151395076d7fb7ca9b798125`
`Hash MD5`	`d38b90dc371589519336d0c092529213`
`Hash MD5`	`d71036dbaff60b41cc4fd767be595997`
`Hash MD5`	`d953809c842ada81c92bfbf9c7088671`
`Hash MD5`	`db0d857a85478d3271c404548574d88f`
`Hash MD5`	`e614b22e081429a22b31a5eb7fedcc21`
`Hash MD5`	`e99e6b583d77db4337e07af0ad0452dc`
`Hash MD5`	`ebbdb20711323dc22a5619ea3a3a2f25`
`Hash MD5`	`ebc321e4c8b761c50d13dc0d8cb86d72`
`Hash MD5`	`ed83c8e2dcc966748548be0e36fb90ce`
`Hash MD5`	`eda59d39892f40dbd14925432f9ba108`
`Hash MD5`	`edcdc4df9344765a584561e0a0f64676`
`Hash MD5`	`ee6ece14cd94c5a7ba9e47bca260c1f2`
`Hash MD5`	`f40a9023601154d7d61b349ab2945c97`
`Hash MD5`	`f58df2bfe9029301131370a318628026`
`Hash MD5`	`f78073b1b2de009645a0254507b87a37`
`Hash MD5`	`f78deca349a87b5966e3566ada4fb3e8`
`Hash MD5`	`fa2c07869bbc5d77c28eb79ef452c0c9`
`Hash MD5`	`fead64a37461b9e5d0875ebec870152a`

Victims (49)

Claro