Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    0b1780772e521630e77a1f6b32201bed228a9c97134c9f462d5ac8d6b08ccae4.zip

  • Size

    185KB

  • Sample

    230516-wlr55abh75

  • MD5

    de5b534d0e0fe4c9ad644b4f3930e0e5

  • SHA1

    f68d234c8a30396c2895087d3732b3083fb66093

  • SHA256

    1397af025217d33a3af3debc6d6fe621ca0d9f2e6797abde411f58e752f054b6

  • SHA512

    c34416109048767318bc3d946b418cb58388edb0a883634866c4663c730cd5dc5998487b4ca9f81fcfdfaaa58722f0092dd8858c7a665d9d4dae3d7f82802f93

  • SSDEEP

    3072:J5ULM4KqRdrCTUO1n+Ki+/hBAYdY++LpF6GRf5RXlTiz67vghstOfX7dX5mAfg:fZx22TR1n/fjvSXyDhs0fX7jffg

Malware Config

Extracted

Family

smokeloader

Botnet

sprg

Extracted

Family

smokeloader

Version

2022

C2

http://hoh0aeghwugh2gie.com/

http://hie7doodohpae4na.com/

http://aek0aicifaloh1yo.com/

http://yic0oosaeiy7ahng.com/

http://wa5zu7sekai8xeih.com/

rc4.i32
1
0x090cd984
rc4.i32
1
0x0d8ab546

Targets

    • Target

      0b1780772e521630e77a1f6b32201bed228a9c97134c9f462d5ac8d6b08ccae4.exe

    • Size

      313KB

    • MD5

      4db73a32cecfa765907e892b7aea8345

    • SHA1

      c420d45d39f21d01bfc71eafd0750fe3cc256a63

    • SHA256

      0b1780772e521630e77a1f6b32201bed228a9c97134c9f462d5ac8d6b08ccae4

    • SHA512

      0007ffba3eb76a2240da84b5b8138d939dd512a6ffb59f83dfce730c5dcf06635b408c5b20bfbd99d254530e0f8bd5deb6f60b4ef49e1b5b6f558e2d3f9fd9a1

    • SSDEEP

      3072:iAXPGgaSaDNJOanCLg3Tcjke0m4gyRAY0+qryYIu+PKPSvNO644vKSgI5gPc3Pgc:3+Sa5MfLgjcwTYyRAYBqryXq4SZOc

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v6

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.