Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    NEAS.43ea825e755b49a93ffba425d9691220_JC.exe

  • Size

    1.9MB

  • Sample

    231101-pgzk3saa72

  • MD5

    43ea825e755b49a93ffba425d9691220

  • SHA1

    0365545977dc62cce5725f1d1b9dcd968ac1f63b

  • SHA256

    3de04c37db073d5432d5d4893d807f0734c6c70dde0779d7076bad770fca5ff3

  • SHA512

    3bf35e7c7ae369c433187a10bd4c607da63524e65edc6ee9d75c8c7281f0fce9d0d9f633a331b756e7b6d6f854cd05e399fc31cd28b9c09f6f20887940787794

  • SSDEEP

    49152:Lz071uv4BPMkibTIA5I4TNrpDGgDQOIktRU:NABV

Score
10/10

Malware Config

Targets

    • Target

      NEAS.43ea825e755b49a93ffba425d9691220_JC.exe

    • Size

      1.9MB

    • MD5

      43ea825e755b49a93ffba425d9691220

    • SHA1

      0365545977dc62cce5725f1d1b9dcd968ac1f63b

    • SHA256

      3de04c37db073d5432d5d4893d807f0734c6c70dde0779d7076bad770fca5ff3

    • SHA512

      3bf35e7c7ae369c433187a10bd4c607da63524e65edc6ee9d75c8c7281f0fce9d0d9f633a331b756e7b6d6f854cd05e399fc31cd28b9c09f6f20887940787794

    • SSDEEP

      49152:Lz071uv4BPMkibTIA5I4TNrpDGgDQOIktRU:NABV

    Score
    10/10
    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

MITRE ATT&CK Enterprise v15

Tasks