Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

20bf38b377...ed.dll

windows7_x64

1

20bf38b377...ed.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    20bf38b377868f4a617011fd9b39790824d0afd1d1ca089083913ebd62bb747f_unpacked

  • Size

    53KB

  • Sample

    211115-wxqfnsbbd4

  • MD5

    c001e3e5483366800062694f9008b442

  • SHA1

    033b3c92ce3d50a34e5160c872092630c6dd3e19

  • SHA256

    20bf38b377868f4a617011fd9b39790824d0afd1d1ca089083913ebd62bb747f

  • SHA512

    accc84ff35b64d140977afae3893d270e1b2443d35574d162042be56c39a04985f87fbc982acf4042e867d0a68a3e97f728474d7911dfe7ba4beb0186d38e652

Score
10/10
squirrelwaffle

Malware Config

Extracted

Family

squirrelwaffle

C2

http://spiritofprespa.com/9783Tci2SGF6

http://amjsys.com/RIZszf8vR

http://hrms.prodigygroupindia.com/SKyufGZV

http://centralfloridaasphalt.com/GCN0FChS

http://jhehosting.com/rUuKheB7

http://shoeclearanceoutlet.co.uk/46awDTJjI4l

http://kmslogistik.com/aS1mjTkJIy

http://bartek-lenart.pl/1bWJ57V9vx

http://voip.voipcallhub.com/ZVmfdGHs4T

http://mercyfoundationcio.org/XF9aQrXnakeG

http://key4net.com/a8A2kcc1J

http://chaturanga.groopy.com/mxN3lxZoVApc

http://voipcallhub.com/ilGht5r26

http://ems.prodigygroupindia.com/v5RvVJTz

http://novamarketing.com.pk/k8l36uus

http://lenartsa.webd.pro/fz16DjmKmHtl

http://lead.jhinfotech.co/YERjiAMaupaz
Attributes
  • blocklist

    94.46.179.80

    206.189.205.251

    88.242.66.45

    85.75.110.214

    87.104.3.136

    207.244.91.171

    49.230.88.160

    91.149.252.75

    91.149.252.88

    92.211.109.152

    178.0.250.168

    88.69.16.230

    95.223.77.160

    99.234.62.23

    2.206.105.223

    84.222.8.201

    89.183.239.142

    5.146.132.101

    77.7.60.154

    45.41.106.122

    45.74.72.13

    74.58.152.123

    88.87.68.197

    211.107.25.121

    109.70.100.25

    185.67.82.114

    207.102.138.19

    204.101.161.14

    193.128.108.251

    111.7.100.17

Targets

    • Target

      20bf38b377868f4a617011fd9b39790824d0afd1d1ca089083913ebd62bb747f_unpacked

    • Size

      53KB

    • MD5

      c001e3e5483366800062694f9008b442

    • SHA1

      033b3c92ce3d50a34e5160c872092630c6dd3e19

    • SHA256

      20bf38b377868f4a617011fd9b39790824d0afd1d1ca089083913ebd62bb747f

    • SHA512

      accc84ff35b64d140977afae3893d270e1b2443d35574d162042be56c39a04985f87fbc982acf4042e867d0a68a3e97f728474d7911dfe7ba4beb0186d38e652

    Score
    10/10

    • Suspicious use of NtCreateProcessExOtherParentProcess

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks