Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
SecuriteInfo.com.Win32.RATX-gen.6.2971.exe
-
Size
267KB
-
Sample
231014-mwxnxsef26
-
MD5
3588601a591bb350581fa5a106db731f
-
SHA1
1c4b62755726646793c3240e9206f98c4b94b91c
-
SHA256
06616799481b155e5794bd4709c2d5cf33a561cb672900107aa0df12090ce2b8
-
SHA512
b63cb213fa8d080ccb178cac94b71f6407e23797c8c6454668286c4635ddcb33b7f5c791e6633538faa25b690800e14fa99fcfaa83e5e6539b58bca541c74b6f
-
SSDEEP
3072:wEvgpVlOeHPHG7OZ6hy2uvnlBrII/J+M:wEvmVlJpj/ly
Malware Config
Extracted
originbotnet
https://nitrosoftwares.shop/gate
-
add_startup
false
-
download_folder_name
5swsrxr4.2li
-
hide_file_startup
false
-
startup_directory_name
MTavMV
-
startup_environment_name
appdata
-
startup_installation_name
MTavMV.exe
-
startup_registry_name
MTavMV
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Targets
-
-
Target
SecuriteInfo.com.Win32.RATX-gen.6.2971.exe
-
Size
267KB
-
MD5
3588601a591bb350581fa5a106db731f
-
SHA1
1c4b62755726646793c3240e9206f98c4b94b91c
-
SHA256
06616799481b155e5794bd4709c2d5cf33a561cb672900107aa0df12090ce2b8
-
SHA512
b63cb213fa8d080ccb178cac94b71f6407e23797c8c6454668286c4635ddcb33b7f5c791e6633538faa25b690800e14fa99fcfaa83e5e6539b58bca541c74b6f
-
SSDEEP
3072:wEvgpVlOeHPHG7OZ6hy2uvnlBrII/J+M:wEvmVlJpj/ly
Score10/10-
OriginBotnet
OriginBotnet is a remote access trojan written in C#.
-
Suspicious use of SetThreadContext
-