Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    13bf3a09d3f3091b802f0719be28393a34ed1c9eeb81e55e471ed9a3e9a5705d

  • Size

    1.2MB

  • Sample

    231114-bgzzysfg3z

  • MD5

    0d197b7740dca482868d3b6dcc14ff0a

  • SHA1

    5d8777c8964274377a6647826a6600c2109a7193

  • SHA256

    13bf3a09d3f3091b802f0719be28393a34ed1c9eeb81e55e471ed9a3e9a5705d

  • SHA512

    821241ded83d87146ea889a7caccf25a7f77bc4d66b417db7f274df43a1a56ae3d792598de3b563fa74f68b41520588408f63cfe6a2b3b580dc793d7e729cff3

  • SSDEEP

    24576:+yRiM3yQVNU48Jpb1PhrQHRsCDVp+msGgoU/SLd+:N4MrSphJDWvDmq

Malware Config

Extracted

Family

redline

Botnet

taiga

C2

5.42.92.51:19057

Extracted

Family

smokeloader

Version

2022

C2

http://5.42.92.190/fks/index.php

rc4.i32
1
0x4b3b02b6
rc4.i32
1
0x6ea683ed

Extracted

Family

redline

Botnet

pixelfresh

C2

194.49.94.11:80

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
1
0x33f8f0d2
rc4.i32
1
0xaa0488bb

Extracted

Family

redline

Botnet

@ytlogsbot

C2

194.169.175.235:42691

Targets

    • Target

      13bf3a09d3f3091b802f0719be28393a34ed1c9eeb81e55e471ed9a3e9a5705d

    • Size

      1.2MB

    • MD5

      0d197b7740dca482868d3b6dcc14ff0a

    • SHA1

      5d8777c8964274377a6647826a6600c2109a7193

    • SHA256

      13bf3a09d3f3091b802f0719be28393a34ed1c9eeb81e55e471ed9a3e9a5705d

    • SHA512

      821241ded83d87146ea889a7caccf25a7f77bc4d66b417db7f274df43a1a56ae3d792598de3b563fa74f68b41520588408f63cfe6a2b3b580dc793d7e729cff3

    • SSDEEP

      24576:+yRiM3yQVNU48Jpb1PhrQHRsCDVp+msGgoU/SLd+:N4MrSphJDWvDmq

    • Detect Mystic stealer payload

    • Detect ZGRat V1

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Modifies Windows Defender Real-time Protection settings

    • Mystic

      Mystic is an infostealer written in C++.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Downloads MZ/PE file

    • Modifies Windows Firewall

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.