Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
dropThaTGhettoBlasterBoris.dll
-
Size
418KB
-
Sample
230511-tjwz7abg7x
-
MD5
6d0aab1f794a3442d7d9fb257eb9882b
-
SHA1
fd084496b02c006f36c9cf4870aff73168925e5a
-
SHA256
0487a3c0917e9552bfc18bd87eef605bf9d449070e0d45f8c295b9e10b57a65c
-
SHA512
cfc9455d81db7f258a3ac65d3906cc57439aff5af6fdc94ee73126c4cb29184709c8866791c9504b2f3d87d78900f35a6e4b6c30e9fa61150c99ec673189527d
-
SSDEEP
6144:Fnb/YzXA6ZNHyqh8vKlhDdNwEXtKmrSPWaDw3kOuOI+Xuizf8H:9/Cw6Z4nilhFX8mCXDckOPeJ
Static task
static1
Behavioral task
behavioral1
Sample
dropThaTGhettoBlasterBoris.dll
Resource
win7-20230220-en
Malware Config
Extracted
qakbot
404.1038
BB27
1683816541
68.68.170.218:443
142.189.121.178:2222
213.91.235.146:443
71.78.95.86:995
92.9.45.20:2222
81.229.117.95:2222
201.244.108.183:995
50.68.186.195:443
90.104.151.37:2222
92.188.241.102:443
198.2.51.242:993
12.172.173.82:20
72.222.73.150:443
31.190.225.7:443
70.54.65.197:2222
70.28.50.223:2083
172.115.17.50:443
70.112.206.5:443
122.184.143.86:443
47.32.78.150:443
92.239.81.124:443
47.199.241.39:443
67.177.41.245:443
72.134.124.16:443
12.172.173.82:995
99.230.89.236:2078
87.202.101.164:50000
193.253.53.157:2078
76.178.148.107:2222
41.186.88.38:443
147.219.4.194:443
47.34.30.133:443
68.14.195.55:995
98.37.25.99:443
188.28.72.118:443
119.82.121.87:443
67.10.9.125:995
184.182.66.109:443
78.192.109.105:2222
74.92.243.115:50000
85.61.165.153:2222
97.93.192.2:2083
62.35.100.38:443
98.187.21.2:443
81.156.1.223:443
84.108.200.161:443
190.141.193.170:443
96.56.197.26:2222
86.196.12.21:2222
72.205.104.134:443
197.148.17.17:2078
70.53.193.201:2222
47.205.25.170:443
207.107.118.2:443
12.172.173.82:465
75.143.236.149:443
72.188.103.221:443
14.192.241.76:995
84.35.26.14:995
86.140.160.231:2222
70.28.50.223:1194
108.190.115.159:443
24.69.137.232:2222
47.21.51.138:443
173.206.84.174:443
79.47.207.6:443
76.16.49.134:443
64.121.161.102:443
98.19.224.125:995
184.176.35.223:2222
67.61.61.31:443
80.12.88.148:2222
75.109.111.89:443
12.20.0.235:2222
88.126.94.4:50000
88.171.156.150:50000
75.98.154.19:443
70.51.136.238:2222
96.87.28.170:2222
73.22.121.210:443
113.11.92.30:443
86.130.9.208:2222
27.109.19.90:2078
70.28.50.223:32100
89.129.109.27:2222
12.172.173.82:21
70.28.50.223:2087
200.93.26.107:2222
50.68.204.71:993
12.172.173.82:32101
173.88.135.179:443
70.28.50.223:3389
86.99.48.130:2222
67.219.197.94:443
76.64.99.251:2222
86.250.12.86:2222
136.35.241.159:443
69.157.243.204:2222
216.36.153.248:443
173.176.4.133:443
92.154.17.149:2222
178.152.124.169:443
83.114.60.6:2222
24.206.27.39:443
184.153.132.82:443
68.109.240.71:443
208.180.17.32:2222
109.159.119.82:2222
186.52.239.187:995
190.28.74.251:443
86.244.255.82:2222
12.172.173.82:993
50.68.204.71:995
50.68.204.71:443
96.56.197.26:2083
37.14.229.220:2222
162.248.14.107:443
186.64.67.41:443
70.28.50.223:2222
-
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Targets
-
-
Target
dropThaTGhettoBlasterBoris.dll
-
Size
418KB
-
MD5
6d0aab1f794a3442d7d9fb257eb9882b
-
SHA1
fd084496b02c006f36c9cf4870aff73168925e5a
-
SHA256
0487a3c0917e9552bfc18bd87eef605bf9d449070e0d45f8c295b9e10b57a65c
-
SHA512
cfc9455d81db7f258a3ac65d3906cc57439aff5af6fdc94ee73126c4cb29184709c8866791c9504b2f3d87d78900f35a6e4b6c30e9fa61150c99ec673189527d
-
SSDEEP
6144:Fnb/YzXA6ZNHyqh8vKlhDdNwEXtKmrSPWaDw3kOuOI+Xuizf8H:9/Cw6Z4nilhFX8mCXDckOPeJ
-