Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    bfa84bc252bb1df372fd8ff6fa89f0c1fdcd03a89f0aea14d975aee63cd97529

  • Size

    390KB

  • Sample

    200123-bg1ltnag9j

  • MD5

    d08febbd886d002584fa5f8e384f6249

  • SHA1

    9a5db9dd9ecd11179e84d9894d97c28db435455d

  • SHA256

    bfa84bc252bb1df372fd8ff6fa89f0c1fdcd03a89f0aea14d975aee63cd97529

  • SHA512

    26f9e98c99bb849fa46d0fbafdb9f29d0b0b30d2e79d38c386f193dd32431cf5cef62360f8f598f8086cca8f2377c21bb71219115b33c5c881d45e2ee38a40a4

Malware Config

Extracted

Family

emotet

Botnet

Epoch3

C2

72.176.87.136:80

150.246.246.238:80

202.229.211.95:80

178.33.167.120:8080

144.76.56.36:8080

176.58.93.123:80

51.38.134.203:8080

185.207.57.205:443

192.241.220.183:8080

24.141.12.228:80

82.79.244.92:80

186.223.86.136:443

154.73.137.131:80

98.15.140.226:80

177.103.240.93:80

142.93.87.198:8080

158.69.167.246:8080

203.124.57.50:80

91.83.93.103:443

157.7.164.178:8081

rsa_pubkey.plain

Targets

    • Target

      bfa84bc252bb1df372fd8ff6fa89f0c1fdcd03a89f0aea14d975aee63cd97529

    • Size

      390KB

    • MD5

      d08febbd886d002584fa5f8e384f6249

    • SHA1

      9a5db9dd9ecd11179e84d9894d97c28db435455d

    • SHA256

      bfa84bc252bb1df372fd8ff6fa89f0c1fdcd03a89f0aea14d975aee63cd97529

    • SHA512

      26f9e98c99bb849fa46d0fbafdb9f29d0b0b30d2e79d38c386f193dd32431cf5cef62360f8f598f8086cca8f2377c21bb71219115b33c5c881d45e2ee38a40a4

    Score
    10/10
    • Emotet

      Emotet is a trojan that is primarily spread through spam emails

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Tasks