Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
DocumentsFolder_729396_Feb_03.one_2.hta
-
Size
5KB
-
Sample
230203-wnhz8sgd94
-
MD5
9367d6f27ef13ffcc8c86ea9c28c3dbf
-
SHA1
4fe41d2d96f8ecddc2830c2a27aef22419c1509b
-
SHA256
4ed16497feaa7bbd98b485d057bf25cb3f24132c6a9f52d4c7b838e6a7f5f761
-
SHA512
09ae3e11d24a5485782a244ae4073b126757ba29a04f8f82ed6126f0a4e8f6bcb19b55229a9f23f190d48373669433fbf9e6af9fea6ae50895a2aea6a99e4c94
-
SSDEEP
96:IhVxy8VC+iNVCv38RGynB8xVpA8oVCynBu9cEAGfPE3rFSEnzAINLuClhkeXbZkh:1gPoWkJuClhkeqH
Static task
static1
Behavioral task
behavioral1
Sample
DocumentsFolder_729396_Feb_03.one_2.hta
Resource
win7-20220812-en
Malware Config
Extracted
qakbot
404.432
obama236
1675410243
79.9.64.37:995
174.104.184.149:443
24.64.112.40:3389
81.151.102.224:443
47.34.30.133:443
86.250.12.217:2222
50.68.204.71:993
156.217.208.137:995
181.118.206.65:995
103.212.19.254:995
83.114.60.6:2222
90.23.19.86:2222
66.131.25.6:443
12.172.173.82:465
86.195.14.72:2222
184.153.132.82:443
91.170.115.68:32100
72.80.7.6:995
71.31.101.183:443
198.2.51.242:993
125.20.112.94:443
92.11.194.53:995
12.172.173.82:32101
31.120.202.209:443
173.18.126.3:443
76.80.180.154:995
24.71.120.191:443
27.0.48.205:443
81.229.117.95:2222
103.252.7.228:443
190.191.35.122:443
87.223.87.126:443
84.35.26.14:995
73.36.196.11:443
171.97.42.67:443
86.225.214.138:2222
172.90.139.138:2222
92.207.132.174:2222
104.35.24.154:443
217.165.186.116:2222
86.194.156.14:2222
87.202.101.164:50000
114.143.176.234:443
98.147.155.235:443
92.154.17.149:2222
86.130.9.197:2222
80.0.74.165:443
86.98.16.24:443
86.196.12.21:2222
87.10.205.117:443
108.2.111.66:995
45.50.233.214:443
12.172.173.82:990
24.228.132.224:2222
74.93.148.97:995
121.121.100.207:995
74.92.243.113:50000
69.119.123.159:2222
202.186.177.88:443
93.238.63.3:995
89.203.252.238:443
201.244.108.183:995
92.8.190.175:2222
50.68.204.71:995
107.146.12.26:2222
49.175.72.56:443
75.143.236.149:443
69.133.162.35:443
12.172.173.82:995
12.172.173.82:2087
50.68.204.71:443
14.202.223.107:443
98.175.176.254:995
184.155.91.69:443
50.68.186.195:443
47.149.137.40:443
183.87.163.165:443
172.248.42.122:443
102.156.32.143:443
50.60.157.175:995
84.215.202.22:443
105.184.159.223:995
73.161.176.218:443
176.142.207.63:443
190.199.188.186:2222
116.86.252.13:2222
67.10.175.47:2222
208.187.122.74:443
180.158.187.35:995
12.172.173.82:50001
82.127.204.82:2222
73.155.10.79:443
91.231.173.199:995
71.52.53.166:443
202.142.98.62:443
161.142.104.187:995
173.76.49.61:443
24.64.112.40:2222
47.21.51.138:995
58.247.115.126:995
175.139.129.94:2222
116.75.63.125:443
116.72.250.18:443
86.96.72.139:2222
103.141.50.151:995
66.191.69.18:995
41.99.114.10:443
64.237.207.9:443
73.165.119.20:443
76.64.202.88:2222
98.145.23.67:443
70.77.116.233:443
105.99.105.0:443
74.33.196.114:443
24.64.112.40:2078
12.172.173.82:20
84.219.213.130:6881
59.28.84.65:443
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Targets
-
-
Target
DocumentsFolder_729396_Feb_03.one_2.hta
-
Size
5KB
-
MD5
9367d6f27ef13ffcc8c86ea9c28c3dbf
-
SHA1
4fe41d2d96f8ecddc2830c2a27aef22419c1509b
-
SHA256
4ed16497feaa7bbd98b485d057bf25cb3f24132c6a9f52d4c7b838e6a7f5f761
-
SHA512
09ae3e11d24a5485782a244ae4073b126757ba29a04f8f82ed6126f0a4e8f6bcb19b55229a9f23f190d48373669433fbf9e6af9fea6ae50895a2aea6a99e4c94
-
SSDEEP
96:IhVxy8VC+iNVCv38RGynB8xVpA8oVCynBu9cEAGfPE3rFSEnzAINLuClhkeXbZkh:1gPoWkJuClhkeqH
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-