Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    a86ac32c277fb4daa9e3e0d5d1765241b50fb342b5ba1152fac5b242e0fab638

  • Size

    1.4MB

  • Sample

    231113-vnegdaeb3y

  • MD5

    091e0dbcb30cf125c8fb0776b68e9bb1

  • SHA1

    c049ae94ceb6caa7367a05e77ab77f57dc403a28

  • SHA256

    a86ac32c277fb4daa9e3e0d5d1765241b50fb342b5ba1152fac5b242e0fab638

  • SHA512

    06a48e3bacba97da90f1757b36248c618fdff16e20db0ace911dcbc06de65f0a314e52d2d6cbd22fc31002c6a97590aa6197cbc32fa980eda1cfd762a18d614f

  • SSDEEP

    24576:bydLsypHX/HAesqwqiYg+sKG5gP2jB1Cz5V7wtfzeriSOZqc:OdpHPAey/H+sKjPgB1ClV4EiSOZq

Malware Config

Extracted

Family

redline

Botnet

taiga

C2

5.42.92.51:19057

Extracted

Family

smokeloader

Version

2022

C2

http://5.42.92.190/fks/index.php

rc4.i32
1
0x4b3b02b6
rc4.i32
1
0x6ea683ed

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
1
0x33f8f0d2
rc4.i32
1
0xaa0488bb

Extracted

Family

redline

Botnet

pixelfresh

C2

194.49.94.11:80

Extracted

Family

redline

Botnet

@ytlogsbot

C2

194.169.175.235:42691

Extracted

Family

redline

Botnet

LiveTraffic

C2

195.10.205.16:1056

Targets

    • Target

      a86ac32c277fb4daa9e3e0d5d1765241b50fb342b5ba1152fac5b242e0fab638

    • Size

      1.4MB

    • MD5

      091e0dbcb30cf125c8fb0776b68e9bb1

    • SHA1

      c049ae94ceb6caa7367a05e77ab77f57dc403a28

    • SHA256

      a86ac32c277fb4daa9e3e0d5d1765241b50fb342b5ba1152fac5b242e0fab638

    • SHA512

      06a48e3bacba97da90f1757b36248c618fdff16e20db0ace911dcbc06de65f0a314e52d2d6cbd22fc31002c6a97590aa6197cbc32fa980eda1cfd762a18d614f

    • SSDEEP

      24576:bydLsypHX/HAesqwqiYg+sKG5gP2jB1Cz5V7wtfzeriSOZqc:OdpHPAey/H+sKjPgB1ClV4EiSOZq

    • Detect Mystic stealer payload

    • Detect ZGRat V1

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Mystic

      Mystic is an infostealer written in C++.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Downloads MZ/PE file

    • Modifies Windows Firewall

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.