Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
1GANG-Nuker.zip
windows10-1703-x64
1GANG-Nuker/GANG.py
windows10-1703-x64
3GANG-Nuker/README.md
windows10-1703-x64
3GANG-Nuker...nt.txt
windows10-1703-x64
1GANG-Nuker...ll.bat
windows10-1703-x64
1GANG-Nuker...ts.txt
windows10-1703-x64
1GANG-Nuker...NG.png
windows10-1703-x64
3GANG-Nuker...ker.py
windows10-1703-x64
3GANG-Nuker...gin.py
windows10-1703-x64
3GANG-Nuker...ter.py
windows10-1703-x64
3GANG-Nuker...ber.py
windows10-1703-x64
3GANG-Nuker...kup.py
windows10-1703-x64
3GANG-Nuker...nfo.py
windows10-1703-x64
3GANG-Nuker...ore.py
windows10-1703-x64
3GANG-Nuker...mon.py
windows10-1703-x64
3GANG-Nuker...rys.py
windows10-1703-x64
3GANG-Nuker...ate.py
windows10-1703-x64
3Analysis
-
max time kernel
50s -
max time network
52s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
19/05/2023, 02:55
Static task
static1
Behavioral task
behavioral1
Sample
GANG-Nuker.zip
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
GANG-Nuker/GANG.py
Resource
win10-20230220-en
Behavioral task
behavioral3
Sample
GANG-Nuker/README.md
Resource
win10-20230220-en
Behavioral task
behavioral4
Sample
GANG-Nuker/data/useragent.txt
Resource
win10-20230220-en
Behavioral task
behavioral5
Sample
GANG-Nuker/install.bat
Resource
win10-20230220-en
Behavioral task
behavioral6
Sample
GANG-Nuker/requirements.txt
Resource
win10-20230220-en
Behavioral task
behavioral7
Sample
GANG-Nuker/utilities/Avatars/GANG.png
Resource
win10-20230220-en
Behavioral task
behavioral8
Sample
GANG-Nuker/utilities/Plugins/Account_Nuker.py
Resource
win10-20230220-en
Behavioral task
behavioral9
Sample
GANG-Nuker/utilities/Plugins/Auto_Login.py
Resource
win10-20230220-en
Behavioral task
behavioral10
Sample
GANG-Nuker/utilities/Plugins/DM_Deleter.py
Resource
win10-20230220-en
Behavioral task
behavioral11
Sample
GANG-Nuker/utilities/Plugins/QR_Grabber.py
Resource
win10-20230220-en
Behavioral task
behavioral12
Sample
GANG-Nuker/utilities/Plugins/Server_Lookup.py
Resource
win10-20230220-en
Behavioral task
behavioral13
Sample
GANG-Nuker/utilities/Plugins/Token_Info.py
Resource
win10-20230220-en
Behavioral task
behavioral14
Sample
GANG-Nuker/utilities/Plugins/ignore/ignore.py
Resource
win10-20230220-en
Behavioral task
behavioral15
Sample
GANG-Nuker/utilities/Settings/common.py
Resource
win10-20230220-en
Behavioral task
behavioral16
Sample
GANG-Nuker/utilities/Settings/libarys.py
Resource
win10-20230220-en
Behavioral task
behavioral17
Sample
GANG-Nuker/utilities/Settings/update.py
Resource
win10-20230220-en
General
-
Target
GANG-Nuker/README.md
-
Size
5KB
-
MD5
ed84eed5757800c682b016dabe4bef13
-
SHA1
b90d6383d956a2f7033ed2a2f739e341f948af72
-
SHA256
6899e1d5412abb7a32b4454e486cc7ba6739071eab852d576f83fb48801f6fad
-
SHA512
8bffeeecf95bbd8dd9e9f3614dabe5b425cd6d98bfa6a378305c373d3deacd563514b5a4ec048b1e2292b12b34adc52d6a32049e8671be7ab9ac9496aa6d95da
-
SSDEEP
96:YPOtdwwF+fSAg67t8JCNVqr3an9kVftQDkuZDlXeeWoH5QEAfa1syx4jUB:MSAl/NIr3a9kgAuooZQEAy1sySjk
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3084 OpenWith.exe