Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
新建文件夹 (2).7z
-
Size
4.9MB
-
Sample
230630-jxpg6age93
-
MD5
5f94ed17f28c2c3f9fa91d953d17dd19
-
SHA1
34eba3d4d6cfc2c9e4697f455791461f702b69d2
-
SHA256
75fe871f78a0eea5ce5489c0815c230603aa45e2fc5f7bf67414a90888c63407
-
SHA512
8b35c485c1c4b51b69e7bfeb8ca54ef0daefe98fe6ee21eb131fa1cadeeda6cf683ba17fe524097d0e5e99966b326927122e590cbe2da4ce38019a13f558a4db
-
SSDEEP
98304:FSlz52/dwlcmRO2nAa0Qf+mxUQAg7PiY2DPrnZoOanzEQwNG2Nvk+TIf5g+:FOz52F1L2ftOBC7SzCO2zGJNvBsJ
Behavioral task
behavioral1
Sample
新建文件夹 (2)/_D0DE469BB8424834A796EDFE1D0176CA.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
新建文件夹 (2)/_D0DE469BB8424834A796EDFE1D0176CA.exe
Resource
win10v2004-20230621-en
Behavioral task
behavioral3
Sample
新建文件夹 (2)/f49acfb27630f8962eb2fe80da75b3e09f4b3d69c8d3c316687200a1c8aa1f4f.msi
Resource
win7-20230621-en
Behavioral task
behavioral4
Sample
新建文件夹 (2)/f49acfb27630f8962eb2fe80da75b3e09f4b3d69c8d3c316687200a1c8aa1f4f.msi
Resource
win10v2004-20230621-en
Behavioral task
behavioral5
Sample
新建文件夹 (2)/新建文件夹/Agghosts.exe
Resource
win7-20230621-en
Behavioral task
behavioral6
Sample
新建文件夹 (2)/新建文件夹/Agghosts.exe
Resource
win10v2004-20230621-en
Malware Config
Targets
-
-
Target
新建文件夹 (2)/_D0DE469BB8424834A796EDFE1D0176CA.exe
-
Size
2.1MB
-
MD5
4ac3d60c4850e37a9b39976c1553df05
-
SHA1
45e5a0e35be7034e38543fc1a0c3f9ca3808fa5c
-
SHA256
c53eac22482ec00bebb3c006d442c7b48a448f9d0cc16a743af9a88de1a1da6c
-
SHA512
7b1e7044deab0f485e1968000df3409d003c38728ab6c07026b5818ed3f0550c32afa0149903e6696e306284b2680426ca8e38540292b35f60d3a8827d789753
-
SSDEEP
49152:vepDNj9UCdjGNjXn/S1qe7FFsOAckBNMmH3Cy+3u:vKNjuCpaj61RjONQy++
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Loads dropped DLL
-
Drops file in System32 directory
-
-
-
Target
新建文件夹 (2)/f49acfb27630f8962eb2fe80da75b3e09f4b3d69c8d3c316687200a1c8aa1f4f.msi
-
Size
2.4MB
-
MD5
64039f083c96cab5ea0de62f789886ce
-
SHA1
ffb89927ad892b7d6e3d6a88ec24a9d6a161dee2
-
SHA256
f49acfb27630f8962eb2fe80da75b3e09f4b3d69c8d3c316687200a1c8aa1f4f
-
SHA512
8eee7c46b8a031858acabe871616e92e95d2e3b4be5b8eae425bc412dc51470c578c6991ba2f3d290a1b96a556853454ea0bb69336e54b9b7aa28354af998fae
-
SSDEEP
49152:3BiErnG0fwkAjwzYUrngrwjCBt4CFFDO84D2nng01WQhNzvS65R8ct:XnGvMzYUrhjCBZPO84DH01WQXzvP5xt
Score6/10-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
-
-
Target
新建文件夹 (2)/新建文件夹/Agghosts.exe
-
Size
29KB
-
MD5
614ceaa6ab7f39714e24e9e6b7b0c7b4
-
SHA1
83b63819fe9a9b8c1624e9969fe125088a873cdc
-
SHA256
e46b0297c7cf534ce46bc673062ed903d11b574fb0602c3bb1a30eb4bbf6f05f
-
SHA512
406bc2d2602d0b18e41148c211ceeb65580402046b205ae5e2a65421d02e2fb1ffc4fee76fb803b9e3f7b00081375a36b6b9162729ea447a7f10997716529483
-
SSDEEP
768:CIl97bHB8CCzEVz1Btnb1WYiRSoQu1xPij97h:xl977KCUUhnbY7RL71x6j9N
Score10/10-
FatalRat
FatalRat is a modular infostealer family written in C++ first appearing in June 2021.
-
Fatal Rat payload
-
Adds Run key to start application
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-