Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
3e0365be4a6ef3ee630468623321921e4aedafaec583e9719fbe365fd39ec8bb
-
Size
1.5MB
-
Sample
230901-qnysssfc25
-
MD5
3a989f7295fd443230ab9fd4b97f7d69
-
SHA1
ecd13b60ae09d41611eeca927ea5ae31a0cc3018
-
SHA256
3e0365be4a6ef3ee630468623321921e4aedafaec583e9719fbe365fd39ec8bb
-
SHA512
5df1c7a765d75c3464bd8295f4aecc874566613df6c538855b8e63e993a2744c4a07e6206b9d1e276eb43818e62f198d24d839a5b506c3b11b291885b3691933
-
SSDEEP
24576:7EYtfWQEem2sujn/HqofMWdOgaCfJ46Sg0jmINRrZD1:7pExemMjn3fMWdoCf5Sg0qINlZD1
Static task
static1
Behavioral task
behavioral1
Sample
3e0365be4a6ef3ee630468623321921e4aedafaec583e9719fbe365fd39ec8bb.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
3e0365be4a6ef3ee630468623321921e4aedafaec583e9719fbe365fd39ec8bb.exe
Resource
win10v2004-20230831-en
Malware Config
Extracted
cobaltstrike
http://124.220.78.192:443/7jCy
-
user_agent
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:21.0) Gecko/20130331 Firefox/21.0
Extracted
cobaltstrike
391144938
http://124.220.78.192:443/pixel
-
access_type
512
-
beacon_type
2048
-
host
124.220.78.192,/pixel
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCt+n7qAJEdSjNghrGviDwKssU022LCTlxikXMmkZjbeBzLzipcGhch7JI3C0jsLP1HCRcR5YiG5uS8uekPPSDoZ9oyFhVeXHUUCdKlQv2jujMv6aeZVfZDEIoh2tbhnyRyLSOieLOMIF2aKi64bJn1pULQdsIAo9+aubtjxYJZewIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; WOW64; Trident/5.0)
-
watermark
391144938
Targets
-
-
Target
3e0365be4a6ef3ee630468623321921e4aedafaec583e9719fbe365fd39ec8bb
-
Size
1.5MB
-
MD5
3a989f7295fd443230ab9fd4b97f7d69
-
SHA1
ecd13b60ae09d41611eeca927ea5ae31a0cc3018
-
SHA256
3e0365be4a6ef3ee630468623321921e4aedafaec583e9719fbe365fd39ec8bb
-
SHA512
5df1c7a765d75c3464bd8295f4aecc874566613df6c538855b8e63e993a2744c4a07e6206b9d1e276eb43818e62f198d24d839a5b506c3b11b291885b3691933
-
SSDEEP
24576:7EYtfWQEem2sujn/HqofMWdOgaCfJ46Sg0jmINRrZD1:7pExemMjn3fMWdoCf5Sg0qINlZD1
Score10/10 -