Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    bedd65fafaa2669674465e8001225734903a0f8e2cebb2abb023dca6e1820a26

  • Size

    197KB

  • Sample

    191218-3y5wzkd666

  • MD5

    083519d9e8e06f5bff5418b3c9d7eb0e

  • SHA1

    40a444f5fbb71e4cd464333d35e7d3505c605781

  • SHA256

    bedd65fafaa2669674465e8001225734903a0f8e2cebb2abb023dca6e1820a26

  • SHA512

    d623defb45ff2494bfa3124adfc758d7105364e37bab4317f84bf44a36cfad325f93fbbaff02092726b7399b40f7e630290c6ef32194b3a0d4bb98d8ce3d5b96

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://oneofakindcm.com/wp-content/q5b4qvb/

exe.dropper

https://bar-ola.com/wp-admin/KIdh35kENT/

exe.dropper

http://rinani.com/wp-includes/FFkV/

exe.dropper

https://stephporn.com/wp-admin/jzBARJvm/

exe.dropper

https://wowmotions.com/wp-admin/A8LwzwQ/

Extracted

Family

emotet

Botnet

Epoch2

C2

173.247.19.238:80

174.81.132.128:80

211.44.35.111:80

165.227.156.155:443

167.99.105.223:7080

67.225.179.64:8080

176.31.200.130:8080

104.131.11.150:8080

68.118.26.116:80

190.226.44.20:21

120.150.246.241:80

92.222.216.44:8080

73.214.99.25:80

110.142.38.16:80

24.93.212.32:80

190.53.135.159:21

66.209.97.122:8080

173.91.11.142:80

100.14.117.137:80

2.237.76.249:80

rsa_pubkey.plain

Targets

    • Target

      bedd65fafaa2669674465e8001225734903a0f8e2cebb2abb023dca6e1820a26

    • Size

      197KB

    • MD5

      083519d9e8e06f5bff5418b3c9d7eb0e

    • SHA1

      40a444f5fbb71e4cd464333d35e7d3505c605781

    • SHA256

      bedd65fafaa2669674465e8001225734903a0f8e2cebb2abb023dca6e1820a26

    • SHA512

      d623defb45ff2494bfa3124adfc758d7105364e37bab4317f84bf44a36cfad325f93fbbaff02092726b7399b40f7e630290c6ef32194b3a0d4bb98d8ce3d5b96

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Executes dropped EXE

MITRE ATT&CK Enterprise v6

Tasks