Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

ify.exe

windows7-x64

10

ify.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ify.exe

  • Size

    444KB

  • Sample

    231012-v1ctbagc86

  • MD5

    ff3f7420912be4a76765d062afe35522

  • SHA1

    64e990dcdc497ee4c75b01142abcd358ecee7aae

  • SHA256

    d555867e166d1e48bf13bc517f17565681c4a6ffdfde2a5eb9041b00b9164d8d

  • SHA512

    ae85e0f606930468f81816014a93090576528e732624c911b126dbbcf3329ed1b122441e25108d91d44b0ee753c93905561c0c8683c74204875d6de1f65a531b

  • SSDEEP

    6144:/TWnLxZdS7ykdyV31ctsDsWb93sVqndWR2j5lEFdcdx4PyrYWf5p49MV0Bsim4NL:/mNPYyVFaWaVqnQ8lnwyrYWf5TTn+D

Score
10/10
originbotnetkeyloggerpersistencerattrojan

Malware Config

Extracted

Family

originbotnet

C2

http://yingxnimetals.com/gate

Attributes
  • add_startup

    true

  • download_folder_name

    x5wsbycp.epf

  • hide_file_startup

    true

  • startup_directory_name

    snuXV

  • startup_environment_name

    appdata

  • startup_installation_name

    snuXV.exe

  • startup_registry_name

    snuXV

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0

Targets

    • Target

      ify.exe

    • Size

      444KB

    • MD5

      ff3f7420912be4a76765d062afe35522

    • SHA1

      64e990dcdc497ee4c75b01142abcd358ecee7aae

    • SHA256

      d555867e166d1e48bf13bc517f17565681c4a6ffdfde2a5eb9041b00b9164d8d

    • SHA512

      ae85e0f606930468f81816014a93090576528e732624c911b126dbbcf3329ed1b122441e25108d91d44b0ee753c93905561c0c8683c74204875d6de1f65a531b

    • SSDEEP

      6144:/TWnLxZdS7ykdyV31ctsDsWb93sVqndWR2j5lEFdcdx4PyrYWf5p49MV0Bsim4NL:/mNPYyVFaWaVqnQ8lnwyrYWf5TTn+D

    Score
    10/10
    originbotnetkeyloggerpersistencerattrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks