Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
a34a137becc42b78e35ed7699a36c2d41191f720ecaacedfef163909da54e464
-
Size
319KB
-
Sample
231011-hr1skagd9z
-
MD5
d61ef53aea02ce2cc36147795243c892
-
SHA1
7b7d15fe637223007fce14fd94322e49bb223163
-
SHA256
8cc697e2c2b741c416d3fad038a2e0ab78144d8bceb679afdd08821b2d08453d
-
SHA512
d4a6f946137d62f07d1c421d7d3bd64382457e8369f32e54e9ac7a76edf1a45fc5c6a854373ff42a7d1ddcc4e2155776c39353bf2a2006ca63c87aecd6bad33b
-
SSDEEP
6144:8wrXwXmMNzes51JpwWxW+2VTOaw5xGqIvNwzl/4+3YN:8ewWazeszlcrdKxGqINEl53O
Static task
static1
Behavioral task
behavioral1
Sample
a34a137becc42b78e35ed7699a36c2d41191f720ecaacedfef163909da54e464.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
a34a137becc42b78e35ed7699a36c2d41191f720ecaacedfef163909da54e464.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Extracted
redline
6012068394_99
https://pastebin.com/raw/8baCJyMF
Extracted
redline
pixelscloud
85.209.176.171:80
Extracted
smokeloader
up3
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Extracted
redline
breha
77.91.124.55:19071
Extracted
redline
kukish
77.91.124.55:19071
Targets
-
-
Target
a34a137becc42b78e35ed7699a36c2d41191f720ecaacedfef163909da54e464
-
Size
883KB
-
MD5
f6968ae5f16908f9de1badd90787c062
-
SHA1
7fa032a5a3e4280a4f89a9aa34784397bc3f173d
-
SHA256
a34a137becc42b78e35ed7699a36c2d41191f720ecaacedfef163909da54e464
-
SHA512
2250ab67bbfd095a2a3bb8eee677750a574c97904f77dd8fb011e1f706434ddc41a26c1d36baac3a3ad0234b66a7d83353959289f56c4b3eff8d08b7e638b8fe
-
SSDEEP
12288:B+RAoyKsDW9g145x58OpGHmEJ/qdDyyZpxThSGu4ywSTXI/9:Br/W9g145x58Ops/yVzSVXw9
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Detects Healer an antivirus disabler dropper
-
Glupteba payload
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
SectopRAT payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Modifies Windows Firewall
-
Stops running service(s)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Defense Evasion
Impair Defenses
3Disable or Modify Tools
2Modify Registry
5Subvert Trust Controls
1Install Root Certificate
1