Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
XZD.exe
-
Size
956KB
-
Sample
230419-mzjw8sbh31
-
MD5
332638c6639e013b5bba729b78b9c234
-
SHA1
31b7ad142dfef57d6f8becc4b7b6528c67617827
-
SHA256
683843fe257ddca12e864696830448bc04e7eeb9ab53e42dc185d898462c85fa
-
SHA512
55f9d2def37094bdeb7ca0d59f2869a0ce44725fbddf35e891a466ff0b2cdbb7396a0e60112a9e2b3c88cfd2c15904b2425c43c526fee64de1fc1b6e45b24cf0
-
SSDEEP
24576:isXMIyXL8g2DGwmie5K7lvHLZtVmeTk/u+UqCoKfD+eJKV6Z:Lmd2DG/15KxvzTh+UqRKr0V
Static task
static1
Behavioral task
behavioral1
Sample
XZD.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
XZD.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
remcos
Awele-Host
gdyhjjdhbvxgsfe.gotdns.ch:2718
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
qos.exe
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Rmc-VC3F2C
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Jm
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
XZD.exe
-
Size
956KB
-
MD5
332638c6639e013b5bba729b78b9c234
-
SHA1
31b7ad142dfef57d6f8becc4b7b6528c67617827
-
SHA256
683843fe257ddca12e864696830448bc04e7eeb9ab53e42dc185d898462c85fa
-
SHA512
55f9d2def37094bdeb7ca0d59f2869a0ce44725fbddf35e891a466ff0b2cdbb7396a0e60112a9e2b3c88cfd2c15904b2425c43c526fee64de1fc1b6e45b24cf0
-
SSDEEP
24576:isXMIyXL8g2DGwmie5K7lvHLZtVmeTk/u+UqCoKfD+eJKV6Z:Lmd2DG/15KxvzTh+UqRKr0V
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-