Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
ZAZAgenv2.exe (1).exe
-
Size
3.8MB
-
Sample
230201-ygz2aabf53
-
MD5
5adc42fc3c4641933072fd628c07778b
-
SHA1
88dacdf1ab3aea812c7aaeb0e532edddf22c1ef4
-
SHA256
0db34a2edc14731f5a5b0a0cd0ce855f76a43f0279d0259383682ee59eba43f2
-
SHA512
9fcfda10612301d90846042b8a8ee5519012727caf5c4138037934b6ccd12cd9808c2e1c8378e54cc72b7a26fbc1274224179bb36e17f937b2254ba4b4dc7678
-
SSDEEP
98304:Qu0T+Srp3YVrsk9N8ivyhAdsPSQxhsnWJLXq0f9ogdCyb:QtfSVN8iNISOlJzqwf
Behavioral task
behavioral1
Sample
ZAZAgenv2.exe (1).exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
ZAZAgenv2.exe (1).exe
-
Size
3.8MB
-
MD5
5adc42fc3c4641933072fd628c07778b
-
SHA1
88dacdf1ab3aea812c7aaeb0e532edddf22c1ef4
-
SHA256
0db34a2edc14731f5a5b0a0cd0ce855f76a43f0279d0259383682ee59eba43f2
-
SHA512
9fcfda10612301d90846042b8a8ee5519012727caf5c4138037934b6ccd12cd9808c2e1c8378e54cc72b7a26fbc1274224179bb36e17f937b2254ba4b4dc7678
-
SSDEEP
98304:Qu0T+Srp3YVrsk9N8ivyhAdsPSQxhsnWJLXq0f9ogdCyb:QtfSVN8iNISOlJzqwf
Score10/10-
StormKitty payload
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Nirsoft
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-