Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    efd2a3ddbf2b7e68a8f3359865dfcd6fd1403fb7d1dc945aa7aa4ccb50284ee7

  • Size

    206KB

  • Sample

    231010-fafpysch94

  • MD5

    a9f00edf2f2bda2e9c5c3df403cbc2a7

  • SHA1

    6f06fee048575ed11ef0c7f4bc55462131a1695d

  • SHA256

    efd2a3ddbf2b7e68a8f3359865dfcd6fd1403fb7d1dc945aa7aa4ccb50284ee7

  • SHA512

    e03c7a3fd073bb4e6afd614d83c62483a9e17500c76a92b2bf91ffcc0ac54983723a1fb83f0e9ea28f46c5c822a106d7224415a915000a0c30e31d8d90bbedca

  • SSDEEP

    3072:ZHXDogD65oyY99krdEVnSUptI2u66I0G1QGDS2Ko3Bjy51RT9:FDnD+YLkC/C2DRQGDS2Ko3Bj0T

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://dublebomber.ru/

http://yavasponimayu.ru/

http://nomnetozhedenyuzhkanuzhna.ru/

http://prostosmeritesya.ru/

http://ipoluchayteudovolstvie.ru/

http://super777bomba.ru/

http://specnaznachenie.ru/

http://zakrylki809.ru/

http://propertyminsk.by/

http://iloveua.ir/

http://moyabelorussiya.by/

http://tvoyaradostetoya.ru/

http://zasadacafe.by/

http://restmantra.by/

http://kozachok777.ru/

http://propertyiran.ir/

http://sakentoshi.ru/

http://popuasyfromua.ru/

http://diplombar.by/

rc4.i32
rc4.i32

Targets

    • Target

      efd2a3ddbf2b7e68a8f3359865dfcd6fd1403fb7d1dc945aa7aa4ccb50284ee7

    • Size

      206KB

    • MD5

      a9f00edf2f2bda2e9c5c3df403cbc2a7

    • SHA1

      6f06fee048575ed11ef0c7f4bc55462131a1695d

    • SHA256

      efd2a3ddbf2b7e68a8f3359865dfcd6fd1403fb7d1dc945aa7aa4ccb50284ee7

    • SHA512

      e03c7a3fd073bb4e6afd614d83c62483a9e17500c76a92b2bf91ffcc0ac54983723a1fb83f0e9ea28f46c5c822a106d7224415a915000a0c30e31d8d90bbedca

    • SSDEEP

      3072:ZHXDogD65oyY99krdEVnSUptI2u66I0G1QGDS2Ko3Bjy51RT9:FDnD+YLkC/C2DRQGDS2Ko3Bj0T

MITRE ATT&CK Enterprise v15

Tasks