Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

de2ebb2702...92.exe

windows7_x64

10

de2ebb2702...92.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    de2ebb27023e08b71d091c7695c59192.exe

  • Size

    649KB

  • Sample

    200708-a27kkgs5gn

  • MD5

    de2ebb27023e08b71d091c7695c59192

  • SHA1

    6b5d2d11a1b712b38d6d699612cdd66fcc755db8

  • SHA256

    e67dd040ce53fbf4e0ef2121dabd060c5c764ede3eec55801376b144a0f40419

  • SHA512

    39c16d7f3672c6ee3c848e898a56b678bc7127ed1af0984a726a4557d8cd73ee96cdea1aa97f79e92680acfed7f666fd35e9f456acf15a54308cbc0eedc99071

Score
10/10
modiloaderremcospersistencerattrojan

Malware Config

Targets

    • Target

      de2ebb27023e08b71d091c7695c59192.exe

    • Size

      649KB

    • MD5

      de2ebb27023e08b71d091c7695c59192

    • SHA1

      6b5d2d11a1b712b38d6d699612cdd66fcc755db8

    • SHA256

      e67dd040ce53fbf4e0ef2121dabd060c5c764ede3eec55801376b144a0f40419

    • SHA512

      39c16d7f3672c6ee3c848e898a56b678bc7127ed1af0984a726a4557d8cd73ee96cdea1aa97f79e92680acfed7f666fd35e9f456acf15a54308cbc0eedc99071

    Score
    10/10
    modiloaderremcospersistencerattrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • ServiceHost packer

      Detects ServiceHost packer used for .NET malware

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks