Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    NEAS.5ccfc615476a74dab67334e7793d1970.exe

  • Size

    252KB

  • Sample

    231022-vwgayafe27

  • MD5

    5ccfc615476a74dab67334e7793d1970

  • SHA1

    08996401415eeb012a45b7f9195b39b689d7eacc

  • SHA256

    7a142a9c28389b8812a70de45e7758f040b03d50a1711bb5d3ae0c0673319172

  • SHA512

    0071e6bed95ad5b16cc367c5acf65936817b383b25f6948b38b559c8a9a199f5b907fc1ea9fa0fa7e86f4ff3965713f49adffa741841766614ff5cfea06f82af

  • SSDEEP

    6144:Tn/mmqoa6thacEml/Zlsp5ZWqAOt43fQn38:TemXa6thnnQT38

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

homed

C2

109.107.182.133:19084

Extracted

Family

amadey

Version

3.89

C2

http://77.91.124.1/theme/index.php

Attributes
  • install_dir

    fefffe8cea

  • install_file

    explothe.exe

  • strings_key

    36a96139c1118a354edf72b1080d4b2f

rc4.plain

Extracted

Family

redline

Botnet

kinder

C2

109.107.182.133:19084

Extracted

Family

redline

Botnet

5141679758_99

C2

https://pastebin.com/raw/8baCJyMF

Extracted

Family

redline

Botnet

YT&TEAM CLOUD

C2

185.216.70.238:37515

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

89.23.100.93:4449

Mutex

oonrejgwedvxwse

Attributes
  • delay

    1

  • install

    true

  • install_file

    calc.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Targets

MITRE ATT&CK Enterprise v15

Tasks