Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5

  • Size

    898KB

  • Sample

    221125-ylzw3sbd48

  • MD5

    c6063f1ebf76cb261d34cc179842a3d1

  • SHA1

    0cd817f26d148deb12148254b7814e83ba90cd56

  • SHA256

    a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5

  • SHA512

    ca13fb6dc08d94cc8a7be2a0b88a449495447eb3fdf2efd0b26811304effeae876df8481aa653e4f8a9addf8afc6748ead50d596d23d6bfebfb10957624175e3

  • SSDEEP

    12288:Itb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaBTYWex6A:Itb20pkaCqT5TBWgNQ7aVSx6A

Malware Config

Extracted

Family

xtremerat

C2

ellol.publicvm.com

Targets

    • Target

      a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5

    • Size

      898KB

    • MD5

      c6063f1ebf76cb261d34cc179842a3d1

    • SHA1

      0cd817f26d148deb12148254b7814e83ba90cd56

    • SHA256

      a259696d00cced401546ad7a5853888225b5eb39697984241b5a9f9c52367cd5

    • SHA512

      ca13fb6dc08d94cc8a7be2a0b88a449495447eb3fdf2efd0b26811304effeae876df8481aa653e4f8a9addf8afc6748ead50d596d23d6bfebfb10957624175e3

    • SSDEEP

      12288:Itb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaBTYWex6A:Itb20pkaCqT5TBWgNQ7aVSx6A

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks