Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

2862_16479...30.exe

windows7_x64

10

2862_16479...30.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2862_1647970205_130.exe

  • Size

    4.0MB

  • Sample

    220404-dn32ashba6

  • MD5

    5764a0ba65261a254e96b1b9ab512e70

  • SHA1

    046230107e56c772044c59c010eca6c7cda61a10

  • SHA256

    e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed

  • SHA512

    73d4f6b958c160d9e85f88f0b19af939306a3357739861b205d44907e7e4b656307bb2cd48bafe84dd77527a4092229b8823f7f1f4dadad9c6966ec77df19630

Score
10/10
loaderbotloaderminerpersistence

Malware Config

Targets

    • Target

      2862_1647970205_130.exe

    • Size

      4.0MB

    • MD5

      5764a0ba65261a254e96b1b9ab512e70

    • SHA1

      046230107e56c772044c59c010eca6c7cda61a10

    • SHA256

      e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed

    • SHA512

      73d4f6b958c160d9e85f88f0b19af939306a3357739861b205d44907e7e4b656307bb2cd48bafe84dd77527a4092229b8823f7f1f4dadad9c6966ec77df19630

    Score
    10/10
    loaderbotloaderminerpersistence

    • LoaderBot

      LoaderBot is a loader written in .NET downloading and executing miners.

      loaderminerloaderbot

    • LoaderBot executable

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks