Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    dropThaTGhettoBlasterBoris.dll

  • Size

    418KB

  • Sample

    230511-tjwz7abg7x

  • MD5

    6d0aab1f794a3442d7d9fb257eb9882b

  • SHA1

    fd084496b02c006f36c9cf4870aff73168925e5a

  • SHA256

    0487a3c0917e9552bfc18bd87eef605bf9d449070e0d45f8c295b9e10b57a65c

  • SHA512

    cfc9455d81db7f258a3ac65d3906cc57439aff5af6fdc94ee73126c4cb29184709c8866791c9504b2f3d87d78900f35a6e4b6c30e9fa61150c99ec673189527d

  • SSDEEP

    6144:Fnb/YzXA6ZNHyqh8vKlhDdNwEXtKmrSPWaDw3kOuOI+Xuizf8H:9/Cw6Z4nilhFX8mCXDckOPeJ

Malware Config

Extracted

Family

qakbot

Version

404.1038

Botnet

BB27

Campaign

1683816541

C2

68.68.170.218:443

142.189.121.178:2222

213.91.235.146:443

71.78.95.86:995

92.9.45.20:2222

81.229.117.95:2222

201.244.108.183:995

50.68.186.195:443

90.104.151.37:2222

92.188.241.102:443

198.2.51.242:993

12.172.173.82:20

72.222.73.150:443

31.190.225.7:443

70.54.65.197:2222

70.28.50.223:2083

172.115.17.50:443

70.112.206.5:443

122.184.143.86:443

47.32.78.150:443

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      dropThaTGhettoBlasterBoris.dll

    • Size

      418KB

    • MD5

      6d0aab1f794a3442d7d9fb257eb9882b

    • SHA1

      fd084496b02c006f36c9cf4870aff73168925e5a

    • SHA256

      0487a3c0917e9552bfc18bd87eef605bf9d449070e0d45f8c295b9e10b57a65c

    • SHA512

      cfc9455d81db7f258a3ac65d3906cc57439aff5af6fdc94ee73126c4cb29184709c8866791c9504b2f3d87d78900f35a6e4b6c30e9fa61150c99ec673189527d

    • SSDEEP

      6144:Fnb/YzXA6ZNHyqh8vKlhDdNwEXtKmrSPWaDw3kOuOI+Xuizf8H:9/Cw6Z4nilhFX8mCXDckOPeJ

MITRE ATT&CK Enterprise v6

Tasks