Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

8404719497...57.exe

windows7-x64

10

8404719497...57.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8404719497ca6b5b09ee72a6488eb4bf09f2654b764cc8ff6329fbfe6585ff57

  • Size

    189KB

  • Sample

    221206-ajnh9sdf7t

  • MD5

    0a62f67759e3ccb71f4e2968e8bd3020

  • SHA1

    b4c5dc55dbd5fe6eb24349a26c60411d9f6a99e7

  • SHA256

    8404719497ca6b5b09ee72a6488eb4bf09f2654b764cc8ff6329fbfe6585ff57

  • SHA512

    2a6894a6c9e676410ca2d7fa28a1298a709fecfcb004eb3196d14dd9ebf5b3c36af782b184e35db3931526fb88541f15c49d896666d9a8aec63d985057afc8af

  • SSDEEP

    1536:/vVQb4cLIkN+4Weat2RKLjWlC48Pp9JAcjYSrowfFD:/vVQLIkLWeaA8KlCph99rowfFD

Score
10/10
persistence

Malware Config

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      8404719497ca6b5b09ee72a6488eb4bf09f2654b764cc8ff6329fbfe6585ff57

    • Size

      189KB

    • MD5

      0a62f67759e3ccb71f4e2968e8bd3020

    • SHA1

      b4c5dc55dbd5fe6eb24349a26c60411d9f6a99e7

    • SHA256

      8404719497ca6b5b09ee72a6488eb4bf09f2654b764cc8ff6329fbfe6585ff57

    • SHA512

      2a6894a6c9e676410ca2d7fa28a1298a709fecfcb004eb3196d14dd9ebf5b3c36af782b184e35db3931526fb88541f15c49d896666d9a8aec63d985057afc8af

    • SSDEEP

      1536:/vVQb4cLIkN+4Weat2RKLjWlC48Pp9JAcjYSrowfFD:/vVQLIkLWeaA8KlCph99rowfFD

    Score
    10/10
    persistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks