Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2e9bbf284ccbc74074e8a01169e304a06a76d168a961500289fc0584513176f7

  • Size

    35KB

  • Sample

    220919-1ycy7abcb7

  • MD5

    a595da27123d990e04d34cd593def9f3

  • SHA1

    1e3086e6a00217293d9a767e8a9fa3fcd2c18ce4

  • SHA256

    2e9bbf284ccbc74074e8a01169e304a06a76d168a961500289fc0584513176f7

  • SHA512

    8f2e4d65e9bc000b858de2564983d2d51f8108181107ef9fbd4108761acb6a3fffdbfa586f7e491c2e57a76c616ca90cfaea636e63af4129af12914601fd137f

  • SSDEEP

    768:mzQYScGrIubHuYtvdxwYHw5FAe2QQncwxQM:gQTIubHy5wQQ7

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      2e9bbf284ccbc74074e8a01169e304a06a76d168a961500289fc0584513176f7

    • Size

      35KB

    • MD5

      a595da27123d990e04d34cd593def9f3

    • SHA1

      1e3086e6a00217293d9a767e8a9fa3fcd2c18ce4

    • SHA256

      2e9bbf284ccbc74074e8a01169e304a06a76d168a961500289fc0584513176f7

    • SHA512

      8f2e4d65e9bc000b858de2564983d2d51f8108181107ef9fbd4108761acb6a3fffdbfa586f7e491c2e57a76c616ca90cfaea636e63af4129af12914601fd137f

    • SSDEEP

      768:mzQYScGrIubHuYtvdxwYHw5FAe2QQncwxQM:gQTIubHy5wQQ7

    Score
    10/10
    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks