Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    e5c4fa967fdecbbe065b0a31e5f4d23d.bin

  • Size

    1.5MB

  • Sample

    231031-dxy4psgc5z

  • MD5

    d65e1d087b0a5ecd6542606a1b573619

  • SHA1

    29e81405afb91d001938f50e2aae5e698052615d

  • SHA256

    bcabb547936785850133a9e9959a54c30f9bb91b3caac58f40740ff14ae4b6bd

  • SHA512

    d3fff8f2a124427025a96331caed4aaa48966f2d6124ea9ba28754feef48caf3798d64dacfbb19dcd6772987b7737951ba261867c21a85947a9c0dcc0c5ecbd7

  • SSDEEP

    24576:q/2W8gn9ImV8B6S7NOTyctUuh8Z+8TbQT6GTlzuoga+amrHUMr8GQtQvWwnDsDjz:nWyU8B6S02c+XQT6GTl6ogbHUMr/Qtjr

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

grome

C2

77.91.124.86:19084

Extracted

Family

amadey

Version

3.89

C2

http://77.91.124.1/theme/index.php

Attributes
  • install_dir

    fefffe8cea

  • install_file

    explothe.exe

  • strings_key

    36a96139c1118a354edf72b1080d4b2f

rc4.plain

Extracted

Family

redline

Botnet

kinza

C2

77.91.124.86:19084

Extracted

Family

redline

Botnet

@ytlogsbot

C2

194.169.175.235:42691

Extracted

Family

redline

Botnet

pixelnew

C2

194.49.94.11:80

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

raccoon

Botnet

6a6a005b9aa778f606280c5fa24ae595

C2

http://195.123.218.98:80

http://31.192.23

Attributes
  • user_agent

    SunShineMoonLight

xor.plain

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Targets

    • Target

      e5c4fa967fdecbbe065b0a31e5f4d23d.bin

    • Size

      1.5MB

    • MD5

      d65e1d087b0a5ecd6542606a1b573619

    • SHA1

      29e81405afb91d001938f50e2aae5e698052615d

    • SHA256

      bcabb547936785850133a9e9959a54c30f9bb91b3caac58f40740ff14ae4b6bd

    • SHA512

      d3fff8f2a124427025a96331caed4aaa48966f2d6124ea9ba28754feef48caf3798d64dacfbb19dcd6772987b7737951ba261867c21a85947a9c0dcc0c5ecbd7

    • SSDEEP

      24576:q/2W8gn9ImV8B6S7NOTyctUuh8Z+8TbQT6GTlzuoga+amrHUMr8GQtQvWwnDsDjz:nWyU8B6S02c+XQT6GTl6ogbHUMr/Qtjr

    Score
    1/10
    • Target

      9a03ba6733f992cbc3485444fdc92aa4281a21ccb20c88c7ad359c14ba06701a.exe

    • Size

      1.5MB

    • MD5

      e5c4fa967fdecbbe065b0a31e5f4d23d

    • SHA1

      46f57ec0e35f5ab49e37a8d4a953d45c9ac8f039

    • SHA256

      9a03ba6733f992cbc3485444fdc92aa4281a21ccb20c88c7ad359c14ba06701a

    • SHA512

      6c32bdfce7b0a55b19e900ba6e611f18e56f1f13a9088a4a0cbb36e4b1482113fa6ec2f030d792245ee700ac202e27a9969778bbd2202b71cb24e8ee22c9987b

    • SSDEEP

      24576:UyJmlwZic895l6HwA1M7+8MYQBgQfFixIXEZyyg2dUtnOBGMJkV/lJATt0Ody:jklwZ5QsdgjQB3f4xIXEZe9nC+L0tHd

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detect ZGRat V1

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Modifies Windows Defender Real-time Protection settings

    • Raccoon

      Raccoon is an infostealer written in C++ and first seen in 2019.

    • Raccoon Stealer payload

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Downloads MZ/PE file

    • Stops running service(s)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks