Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

30/06/2023, 08:09

230630-j2ll3agf35 7

30/06/2023, 08:03

230630-jxpg6age93 10

General

  • Target

    新建文件夹 (2).7z

  • Size

    4.9MB

  • Sample

    230630-jxpg6age93

  • MD5

    5f94ed17f28c2c3f9fa91d953d17dd19

  • SHA1

    34eba3d4d6cfc2c9e4697f455791461f702b69d2

  • SHA256

    75fe871f78a0eea5ce5489c0815c230603aa45e2fc5f7bf67414a90888c63407

  • SHA512

    8b35c485c1c4b51b69e7bfeb8ca54ef0daefe98fe6ee21eb131fa1cadeeda6cf683ba17fe524097d0e5e99966b326927122e590cbe2da4ce38019a13f558a4db

  • SSDEEP

    98304:FSlz52/dwlcmRO2nAa0Qf+mxUQAg7PiY2DPrnZoOanzEQwNG2Nvk+TIf5g+:FOz52F1L2ftOBC7SzCO2zGJNvBsJ

Malware Config

Targets

    • Target

      新建文件夹 (2)/_D0DE469BB8424834A796EDFE1D0176CA.exe

    • Size

      2.1MB

    • MD5

      4ac3d60c4850e37a9b39976c1553df05

    • SHA1

      45e5a0e35be7034e38543fc1a0c3f9ca3808fa5c

    • SHA256

      c53eac22482ec00bebb3c006d442c7b48a448f9d0cc16a743af9a88de1a1da6c

    • SHA512

      7b1e7044deab0f485e1968000df3409d003c38728ab6c07026b5818ed3f0550c32afa0149903e6696e306284b2680426ca8e38540292b35f60d3a8827d789753

    • SSDEEP

      49152:vepDNj9UCdjGNjXn/S1qe7FFsOAckBNMmH3Cy+3u:vKNjuCpaj61RjONQy++

    Score
    7/10
    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Drops file in System32 directory

    • Target

      新建文件夹 (2)/f49acfb27630f8962eb2fe80da75b3e09f4b3d69c8d3c316687200a1c8aa1f4f.msi

    • Size

      2.4MB

    • MD5

      64039f083c96cab5ea0de62f789886ce

    • SHA1

      ffb89927ad892b7d6e3d6a88ec24a9d6a161dee2

    • SHA256

      f49acfb27630f8962eb2fe80da75b3e09f4b3d69c8d3c316687200a1c8aa1f4f

    • SHA512

      8eee7c46b8a031858acabe871616e92e95d2e3b4be5b8eae425bc412dc51470c578c6991ba2f3d290a1b96a556853454ea0bb69336e54b9b7aa28354af998fae

    • SSDEEP

      49152:3BiErnG0fwkAjwzYUrngrwjCBt4CFFDO84D2nng01WQhNzvS65R8ct:XnGvMzYUrhjCBZPO84DH01WQXzvP5xt

    Score
    6/10
    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Target

      新建文件夹 (2)/新建文件夹/Agghosts.exe

    • Size

      29KB

    • MD5

      614ceaa6ab7f39714e24e9e6b7b0c7b4

    • SHA1

      83b63819fe9a9b8c1624e9969fe125088a873cdc

    • SHA256

      e46b0297c7cf534ce46bc673062ed903d11b574fb0602c3bb1a30eb4bbf6f05f

    • SHA512

      406bc2d2602d0b18e41148c211ceeb65580402046b205ae5e2a65421d02e2fb1ffc4fee76fb803b9e3f7b00081375a36b6b9162729ea447a7f10997716529483

    • SSDEEP

      768:CIl97bHB8CCzEVz1Btnb1WYiRSoQu1xPij97h:xl977KCUUhnbY7RL71x6j9N

    • FatalRat

      FatalRat is a modular infostealer family written in C++ first appearing in June 2021.

    • Fatal Rat payload

    • Adds Run key to start application

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v6

Tasks