Trigona: configuration resource, key hierarchy and file footer

Scope, snapshot and evidence boundary

ThreatLabz analysis of Trigona plus the official configuration extractor; no claim about activity in 2026. The bounded question is: which architecture and behaviour claims does this specific evidence set support, and which remain attributable only to the source?

What is supported — and what is missing

Primary sources, statically inspectable code and runtime observations carry different evidentiary weight. The map keeps those layers separate; missing first-party observation is not replaced by plausibility.

Entry and delivery chain

The report covers the ransomware core and its configuration, not a universal initial-access path. The Delphi PE contains a resource named CFGS that structures identifiers, RSA material, exclusion lists and the ransom note.

Architecture and data flow

The extractor locates CFGS, removes variable padding, verifies MD5 and parses three length-coded sections. ThreatLabz describes two-layer AES-CBC decryption with residual block termination. For files, Trigona combines per-file AES material with a 4,112-bit RSA key and AES-OFB.

Original code as architecture evidence

The short excerpt shows only the structure discussed in this chapter. It is not executed and does not contain a complete operational implementation.

95def get_config_resource(pe):
96    for rsrc in pe.DIRECTORY_ENTRY_RESOURCE.entries:
97        for entry in rsrc.directory.entries:
98            if entry.name is not None:
99                if entry.name.__str__() == "CFGS":
100                    offset = entry.directory.entries[0].data.struct.OffsetToData
101                    size = entry.directory.entries[0].data.struct.Size
102                    data = pe.get_data(offset, size)
103                    return {"data": data, "size": size}
104    return None
105
106
107def parse_sections(data):
108    cfg = Config()
109    config_stream = Stream(data)
110    padding_bytes = config_stream.read_byte()
111    config_stream.read_bytes(padding_bytes)
112    config_md5 = config_stream.read_bytes(16)
113    cfg_data = config_stream.seek_all()
114    actual_cfg_md5 = hashlib.md5(cfg_data).hexdigest()
115    if actual_cfg_md5 != config_md5.hex():
116        print("invalid config!")
117        return None
118
119    section1_size = config_stream.read_int_dword()
120    section1 = config_stream.read_bytes(section1_size)
121    parse_section1_stream(cfg, section1)
122
123    section2_size = config_stream.read_int_dword()
124    section2 = config_stream.read_bytes(section2_size)
125    extensions = parse_section2_stream(section2)
126    cfg.extensions = extensions
127
128    section3_size = config_stream.read_int_dword()
129    ransom_note = config_stream.read_bytes(section3_size)
130    cfg.ransom_note = ransom_note
131    return cfg

Analysis resistance and persistence

The cryptographic layering protects configuration and file keys but is also structured. MD5, section lengths and footer fields create testable relationships. A magic or extension value alone remains version-dependent and can collide with other software.

Capabilities, objective and impact

The documented encryption path produces files ending in `_locked`; a separate wiper path uses `_erased`. Ransom note, encryption and deletion are therefore distinct effects. Knowing the format does not imply general recoverability without the private RSA key.

Telemetry plan and evidence chain

Detection should connect the CFGS resource, consistent section structure, unusual file renaming, an HTA ransom note and high-volume write activity. Extensions or hashes alone are weak and cannot survive variant changes. A defensible investigation preserves process GUID and full ancestry, user and session, command line, signer and hash state, file and registry changes, DNS/connection destinations and follow-on access to sensitive data in one timeline. Temporal proximity is an evidence parameter, not mere visualization. Missing sensor coverage is marked per stage so that an unseen event is not falsely treated as an event that did not occur.

Detection engineering and countertesting

Detection should connect the CFGS resource, consistent section structure, unusual file renaming, an HTA ransom note and high-volume write activity. Extensions or hashes alone are weak and cannot survive variant changes. The following model is deliberately narrow, not engine-validated and must be tested against legitimate administration and software paths.

1title: Trigona encryption-impact candidate
2status: experimental
3logsource:
4  product: windows
5  category: file_event
6detection:
7  selection:
8    TargetFilename|endswith:
9      - '_locked'
10      - '_erased'
11  filter_legitimate:
12    Image|endswith: '\\backup-agent.exe'
13  condition: selection and not filter_legitimate
14falsepositives:
15  - Legitimate administrative or software activity with the same isolated pattern
16level: medium

Alternative hypotheses and negative tests

Before assigning the family, each signal used by the model is tested independently against software deployment, administration tools, installers, browser or backup software and known internal scripts. At least one structural anchor and one temporally consistent behaviour chain must align. This is a historical, source-bound architecture review. The extractor does not establish support for every variant; extortion or exfiltration claims are not adopted as independently confirmed. A negative countercheck rejects only the tested hypothesis; it is not a general all-clear.

Attribution and variant risk

This is a historical, source-bound architecture review. The extractor does not establish support for every variant; extortion or exfiltration claims are not adopted as independently confirmed.

Final assessment

The review provides a defensible architecture and detection baseline for the named snapshot. It is not proof of current activity, complete variant coverage or a specific operator.

Review limits

• No independent sample, runtime, C2 or campaign verification.
• This is a historical, source-bound architecture review. The extractor does not establish support for every variant; extortion or exfiltration claims are not adopted as independently confirmed.
• Defensive models were not validated with a target engine.