Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Original9968.iso
-
Size
634KB
-
Sample
221019-qqwq8aacdr
-
MD5
eb857f88807119cbabf05c1b22b9fbeb
-
SHA1
dfd2d5e97331212fa98a676c157b174d9f7abb55
-
SHA256
5596dc2185901d13bbd40991e8dbae21b06d5f5f106d7954739718ac3d412a53
-
SHA512
f512fa9fa93a53c3b856fe7f21e374f78c8c93574149c9a96addabf1de2ce6332fddeb1018f0d755d1b8b19e7dff44be805841cd94b8a3f5290fb0291384d3ca
-
SSDEEP
12288:TptV8uc0KS9gpC1GIqv9PmgfKP1KJqnr:TpI2Krp9ILTYJqnr
Static task
static1
Behavioral task
behavioral1
Sample
Originals.lnk
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Originals.lnk
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
carcasses/full.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
carcasses/full.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
carcasses/imams.cmd
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
carcasses/imams.cmd
Resource
win10v2004-20220812-en
Malware Config
Extracted
qakbot
403.973
BB03
1666073717
190.199.99.171:993
41.69.192.245:443
167.58.254.85:443
206.1.172.1:443
5.163.177.234:443
134.35.0.103:443
105.96.221.136:443
41.101.100.7:443
186.177.93.18:2222
78.179.135.247:443
177.205.74.14:2222
102.47.218.41:443
102.156.149.226:443
41.250.48.206:443
41.107.58.251:443
187.198.16.39:443
193.201.187.64:443
41.102.134.89:443
102.159.77.134:995
105.159.49.123:995
197.200.236.69:443
154.247.82.36:443
37.37.80.2:3389
190.11.198.76:443
197.158.87.248:443
186.188.96.197:443
82.12.196.197:443
91.171.72.214:32100
72.88.245.71:443
84.220.94.231:443
151.251.50.117:443
105.154.56.232:995
41.107.116.19:443
159.192.204.135:443
177.152.65.142:443
176.45.35.243:443
104.233.202.195:443
149.126.159.254:443
181.56.171.3:995
200.93.11.28:2222
163.182.177.80:443
72.21.109.1:443
190.193.180.228:443
190.204.112.207:2222
41.97.56.102:443
206.1.208.223:2087
41.251.219.50:443
105.111.141.73:443
190.39.218.17:443
190.100.149.122:995
196.64.70.216:443
196.89.213.40:995
181.168.145.94:443
187.101.200.186:995
41.105.245.174:443
179.25.144.177:995
94.52.127.44:443
186.18.210.16:443
102.158.215.180:443
78.183.238.79:443
197.1.50.150:443
42.189.32.186:80
14.54.83.15:443
71.239.12.136:443
112.70.141.221:443
37.245.136.135:2222
88.232.10.69:443
41.98.250.65:443
82.205.9.34:443
196.64.239.75:443
37.8.68.1:443
197.1.248.244:443
197.2.139.7:443
79.45.134.162:22
182.183.211.163:995
154.246.14.94:443
144.86.17.168:443
182.185.29.69:995
160.177.47.116:6881
181.197.41.173:443
160.248.194.147:443
85.109.221.97:443
125.25.77.249:995
125.26.173.215:443
197.10.195.7:443
45.160.33.163:443
202.170.206.61:995
96.9.66.118:995
132.251.244.227:443
113.188.13.246:443
78.181.39.116:443
1.53.101.75:443
31.201.40.194:443
197.116.178.224:443
79.155.159.177:443
181.188.164.123:443
156.221.50.226:995
41.251.15.7:990
45.240.140.233:995
189.243.187.76:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Targets
-
-
Target
Originals.lnk
-
Size
1KB
-
MD5
5b20c4ff2f74fb557d2b6dc004285231
-
SHA1
ed30fd4d056500060e467898c33f7d51e15a451d
-
SHA256
88cf6c638b912634731c94007ae470e5ca426ab2ef0d455335f4d17c8cd63e5b
-
SHA512
39caac70327860981172054ff7ea62623cc6037bdbde6de4568bfa9046136e382e8685c2c4fcdf6435168f2e6de9cf03b8dab09d9765265abe29e27bf8b3a52d
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
-
-
Target
carcasses/full.des
-
Size
561KB
-
MD5
780c8b903eb2f4b57391c3dbe2d8ffa0
-
SHA1
c7ef52840015e00ea49e80d7bfe5b52abfcc93ca
-
SHA256
9eaa2e60e4285d5a36128ae4df77abb241befed30d3bbfdadc1925277e582c8a
-
SHA512
2afdc2364ff110002ae700f488f8e1ab74007887941c9b89aed277354fe1ccd56f8c36199b75b0b3386d66ec11fe4fc9af8a913fdfb6228b003f5415a07002a8
-
SSDEEP
6144:ypIe6W8uc0KxlK9gpC1d88LKXpAOkuL9P5Qt6frqLwYzbn4NKToC2HD9qFmq:yptV8uc0KS9gpC1GIqv9PmgfKP1KJq
-
-
-
Target
carcasses/imams.cmd
-
Size
371B
-
MD5
6d0bf2f2e321cbeb8bab405200fbb78c
-
SHA1
afc4a5efa9bd3fe9aafeb39824c0ba0bbeaeb826
-
SHA256
fa8f76fefefba73d1f5f75210bd8974bd11c11c7ae88eff46315f083e9c68920
-
SHA512
3a54c39a0bbc412364bbec554a1802870a103cf2f1495d6ff1f647cbe03371a8e4dacb7a49b41c4459ea4e6aea72ea1e8f9552cef158f770143228d2f2971415
Score1/10 -