Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    a34a137becc42b78e35ed7699a36c2d41191f720ecaacedfef163909da54e464

  • Size

    319KB

  • Sample

    231011-hr1skagd9z

  • MD5

    d61ef53aea02ce2cc36147795243c892

  • SHA1

    7b7d15fe637223007fce14fd94322e49bb223163

  • SHA256

    8cc697e2c2b741c416d3fad038a2e0ab78144d8bceb679afdd08821b2d08453d

  • SHA512

    d4a6f946137d62f07d1c421d7d3bd64382457e8369f32e54e9ac7a76edf1a45fc5c6a854373ff42a7d1ddcc4e2155776c39353bf2a2006ca63c87aecd6bad33b

  • SSDEEP

    6144:8wrXwXmMNzes51JpwWxW+2VTOaw5xGqIvNwzl/4+3YN:8ewWazeszlcrdKxGqINEl53O

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32
rc4.i32

Extracted

Family

amadey

Version

3.89

C2

http://77.91.124.1/theme/index.php

Attributes
  • install_dir

    fefffe8cea

  • install_file

    explothe.exe

  • strings_key

    36a96139c1118a354edf72b1080d4b2f

rc4.plain

Extracted

Family

redline

Botnet

6012068394_99

C2

https://pastebin.com/raw/8baCJyMF

Extracted

Family

redline

Botnet

pixelscloud

C2

85.209.176.171:80

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

breha

C2

77.91.124.55:19071

Extracted

Family

redline

Botnet

kukish

C2

77.91.124.55:19071

Targets

    • Target

      a34a137becc42b78e35ed7699a36c2d41191f720ecaacedfef163909da54e464

    • Size

      883KB

    • MD5

      f6968ae5f16908f9de1badd90787c062

    • SHA1

      7fa032a5a3e4280a4f89a9aa34784397bc3f173d

    • SHA256

      a34a137becc42b78e35ed7699a36c2d41191f720ecaacedfef163909da54e464

    • SHA512

      2250ab67bbfd095a2a3bb8eee677750a574c97904f77dd8fb011e1f706434ddc41a26c1d36baac3a3ad0234b66a7d83353959289f56c4b3eff8d08b7e638b8fe

    • SSDEEP

      12288:B+RAoyKsDW9g145x58OpGHmEJ/qdDyyZpxThSGu4ywSTXI/9:Br/W9g145x58Ops/yVzSVXw9

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Detected google phishing page

    • Detects Healer an antivirus disabler dropper

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Healer

      Healer an antivirus disabler dropper.

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Modifies Windows Firewall

    • Stops running service(s)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks