Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

6663d175c5...58.exe

windows7-x64

10

6663d175c5...58.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6663d175c5bd8439801c324b7834ff65bb37351c5b563e52306721d95fd47d58

  • Size

    208KB

  • Sample

    221106-rl5c8shbcm

  • MD5

    06371953079ee30062990ae307693a09

  • SHA1

    626802beb32d34c1013d046f6909ffc43f39d979

  • SHA256

    6663d175c5bd8439801c324b7834ff65bb37351c5b563e52306721d95fd47d58

  • SHA512

    22c1dc68999510ab2d5f3ccd02173c3f3cb5b4a7c02da68f00492df89b050bcf708d1ce12d54e10f41dde899b8572dbd1b35dc9e2b6dff5cc17d3c53dbe956ec

  • SSDEEP

    3072:bChJgYMm4xf9cU9KQ2BxA59SPMpOoIn2s:3YMm4xiWKQ2BiCM8

Score
10/10
persistence

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      6663d175c5bd8439801c324b7834ff65bb37351c5b563e52306721d95fd47d58

    • Size

      208KB

    • MD5

      06371953079ee30062990ae307693a09

    • SHA1

      626802beb32d34c1013d046f6909ffc43f39d979

    • SHA256

      6663d175c5bd8439801c324b7834ff65bb37351c5b563e52306721d95fd47d58

    • SHA512

      22c1dc68999510ab2d5f3ccd02173c3f3cb5b4a7c02da68f00492df89b050bcf708d1ce12d54e10f41dde899b8572dbd1b35dc9e2b6dff5cc17d3c53dbe956ec

    • SSDEEP

      3072:bChJgYMm4xf9cU9KQ2BxA59SPMpOoIn2s:3YMm4xiWKQ2BiCM8

    Score
    10/10
    persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks