{"id":2992,"date":"2024-09-25T20:53:35","date_gmt":"2024-09-25T20:53:35","guid":{"rendered":"https:\/\/xdr-mdr.lmntrix.com\/main_web\/?p=2992"},"modified":"2025-07-29T06:54:31","modified_gmt":"2025-07-29T06:54:31","slug":"tron-ransomware-infecting-only-non-russian-victims","status":"publish","type":"post","link":"https:\/\/lmntrix.com\/blog\/tron-ransomware-infecting-only-non-russian-victims\/","title":{"rendered":"Tron Ransomware – Infecting only Non-Russian Victims!"},"content":{"rendered":"
\n
\"\"<\/figure>\n<\/div>\n\n\n

Overview<\/strong>

The LMNTRIX Threat Intelligence Platform has recently found a new variant of Tron, a ransomware that targets non-Russians, under the microscope.  This sample underwent analysis:

File Hash (SHA-256): fb45f10c886974e29a57673769c0bc4e53fcaf063e172e38d92eea85bf570aff

File Size: 87.5 KB

File creation- TimeDateStamp: (Thu Apr 12 16:54:17 2018)

Infection<\/strong>

 <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n



Figure 1 VT result for Tron Ransomware<\/em>

Analysis of the Ransomware sample<\/strong>

Our researcher team checked the file\u2019s PE details it found to be compiled using .Net.

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

 

Figure 2 Compiled using .Net<\/em>

We listed the following malicious indicator in the sample as shown in the screenshot:

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

 

Figure 3 Malicious Indicator<\/em>

Blacklisted strings count is 38 and the original file name is Tron.exe. Our researcher dissected the sample and analyse the code.

Threat Indicators    <\/strong>                                           

When we dissected the codes, we found the file locations in the victim\u2019s system that would be targeted by the ransomware.

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

 

Figure 4 Targeted folders<\/em>

When we executed the file, it encrypted the files in all those folders listed above. And it added the file extension as \u2018Tron\u2019 after encryption:

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

 

Figure 5 Tron Extension added after encryption<\/em>
<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

 

Figure 6 Ransom notes and Payment methods<\/em>

Not Russia Then Exit<\/strong>

In this code, we found that this ransomware sense the geo location and if it detects the location as Russia then it exits.

<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

 

Figure 7 If Russia then exit<\/em>

Threat Indicators

IOC details:
<\/p>\n\n\n\n

File Hashes:

SHA 256: fb45f10c886974e29a57673769c0bc4e53fcaf063e172e38d92eea85bf570aff

SHA 256: 41b9d94f13dd2b2d9d3b01df692f1837731a932e2ae938cccf34905064f6f30f
<\/p>\n\n\n\n

File extension added by this variant of ransomware:

\u2018.tron\u2019
<\/p>\n\n\n\n

Conclusion<\/strong>

We suspect that we will continue to see the rise of geo-targeted ransomware, which in part, has the advantage for threat actors of presumably limiting local law enforcement concerns about their activities since there targets are outside of their own geographic jurisdictions.

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Overview The LMNTRIX Threat Intelligence Platform has recently found a new variant of Tron, a ransomware that targets non-Russians, under the microscope.  This sample underwent analysis: File Hash (SHA-256): fb45f10c886974e29a57673769c0bc4e53fcaf063e172e38d92eea85bf570aff File Size: 87.5 KB File creation- TimeDateStamp: (Thu Apr 12 16:54:17 2018) Infection   Figure 1 VT result for Tron Ransomware Analysis of the Ransomware […]<\/p>\n","protected":false},"author":1,"featured_media":3020,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21],"tags":[],"class_list":["post-2992","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-labs"],"_links":{"self":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/2992","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/comments?post=2992"}],"version-history":[{"count":5,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/2992\/revisions"}],"predecessor-version":[{"id":4351,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/2992\/revisions\/4351"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/media\/3020"}],"wp:attachment":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/media?parent=2992"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/categories?post=2992"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/tags?post=2992"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}