Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    5435fb0e3fe2fdba92f710ccc9925916667aa83858e054f7b04312aa8d8d86eb

  • Size

    175KB

  • Sample

    231003-ffaqwsab52

  • MD5

    aac78682a5ba0426449d01bade845cb0

  • SHA1

    41d02c00f5b06010085b4dcb2a9ce0d896300c9d

  • SHA256

    5435fb0e3fe2fdba92f710ccc9925916667aa83858e054f7b04312aa8d8d86eb

  • SHA512

    a53cc5ad0025ae9fbf7120d847e422f36d8b749c40841492586df22aa2e262c84a019f6f05d049d725c2319841671d39faeec0970796dce62f1502cb32ab0fc7

  • SSDEEP

    3072:xVNvDshUKee5ivyM2Em+Nay4V1ERc6g3DT8Twm0hIgsJIpH9ygW:MUHvyIm+NQVSRcGwn3s6yx

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32
1
0x4b3b02b6
rc4.i32
1
0x6ea683ed

Extracted

Family

amadey

Version

3.89

C2

http://77.91.124.1/theme/index.php

Attributes
  • install_dir

    fefffe8cea

  • install_file

    explothe.exe

  • strings_key

    36a96139c1118a354edf72b1080d4b2f

rc4.plain
1
006700e5a2ab05704bbb0c589b88924d

Extracted

Family

redline

Botnet

jordan

C2

77.91.124.55:19071

Extracted

Family

redline

Botnet

larek

C2

77.91.124.55:19071

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

redline

Botnet

@ytlogsbot

C2

176.123.4.46:33783

Attributes
  • auth_value

    295b226f1b63bcd55148625381b27b19

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
1
0x33f8f0d2
rc4.i32
1
0xaa0488bb

Extracted

Family

fabookie

C2

http://app.nnnaajjjgc.com/check/safe

Targets

    • Target

      5435fb0e3fe2fdba92f710ccc9925916667aa83858e054f7b04312aa8d8d86eb

    • Size

      175KB

    • MD5

      aac78682a5ba0426449d01bade845cb0

    • SHA1

      41d02c00f5b06010085b4dcb2a9ce0d896300c9d

    • SHA256

      5435fb0e3fe2fdba92f710ccc9925916667aa83858e054f7b04312aa8d8d86eb

    • SHA512

      a53cc5ad0025ae9fbf7120d847e422f36d8b749c40841492586df22aa2e262c84a019f6f05d049d725c2319841671d39faeec0970796dce62f1502cb32ab0fc7

    • SSDEEP

      3072:xVNvDshUKee5ivyM2Em+Nay4V1ERc6g3DT8Twm0hIgsJIpH9ygW:MUHvyIm+NQVSRcGwn3s6yx

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Detect Fabookie payload

    • Detects Healer an antivirus disabler dropper

    • Fabookie

      Fabookie is facebook account info stealer.

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Healer

      Healer an antivirus disabler dropper.

    • Modifies Windows Defender Real-time Protection settings

    • Mystic

      Mystic is an infostealer written in C++.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Downloads MZ/PE file

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Windows security modification

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.