Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    7447286776b1dcf485f180b1ae3b68e78dc11fe35e77cb764347db262c00b83a

  • Size

    908KB

  • Sample

    220625-cw9clsafbp

  • MD5

    c3092da1a5e433192a8937a725144db9

  • SHA1

    55f76748ef5e034d0f9e5beb976bf302a8e612e5

  • SHA256

    7447286776b1dcf485f180b1ae3b68e78dc11fe35e77cb764347db262c00b83a

  • SHA512

    6b2a2206a8e64a3ced2982d8aeaeaba8092f9105f7bbfe7bb32dd3b3dd607b8b3b82370c60a23bae8b11f0f10127732d27c01ad8c9ba9ffcce2f3120672e8342

Malware Config

Extracted

Family

gozi_rm3

Attributes
  • build

    300854

Extracted

Family

gozi_rm3

Botnet

202004141

C2

https://devicelease.xyz

Attributes
  • build

    300854

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • server_id

    12

  • url_path

    index.htm

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDD3AfU4ayUEHchQ3H0W1/d3ziW
3
VNCFHWaAm8mJq6hQwn03GNGV7hOICH8h/+dZGEwYWVnRq128QMPZTIj0b+iqHKlM
4
sHzxEIZlWUVvnfbx6unDAC8aJXovmePrPvbHJ1FrplzlbILiPLvofh7pXzTdfcDQ
5
e3wfV7cbxJ3DXessqwIDAQAB
6
-----END PUBLIC KEY-----
serpent.plain
1
8JbpEEfNYPlYoAN4

Targets

    • Target

      7447286776b1dcf485f180b1ae3b68e78dc11fe35e77cb764347db262c00b83a

    • Size

      908KB

    • MD5

      c3092da1a5e433192a8937a725144db9

    • SHA1

      55f76748ef5e034d0f9e5beb976bf302a8e612e5

    • SHA256

      7447286776b1dcf485f180b1ae3b68e78dc11fe35e77cb764347db262c00b83a

    • SHA512

      6b2a2206a8e64a3ced2982d8aeaeaba8092f9105f7bbfe7bb32dd3b3dd607b8b3b82370c60a23bae8b11f0f10127732d27c01ad8c9ba9ffcce2f3120672e8342

MITRE ATT&CK Enterprise v6

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.