Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
601ea83a4a3b3ba5037c8185d1b8f521091a9bcc2a1676c6e047518405c91d58.zip
-
Size
1.5MB
-
Sample
231119-1jhacscg3w
-
MD5
32e55ff3645c839dbe3192c6ab028d0f
-
SHA1
37d95ccb022e4e0de4be84c431166aaeceaa75a4
-
SHA256
27a0bbd03f439aef6edab075fdc495ad7e6b4cdc21f387c278802f9b447b61c3
-
SHA512
60e84aa6cd61fc83d909ccf24d33b9979f21e9db6061038f52ef0e30ce67b877033631f41cd4f8e486a82131e682128de03e12f2d1ec0363cc83d7a041bca8d0
-
SSDEEP
49152:Fy2KPveRPuJf8+QN5rEDUs49y8G9b7Cyh15P0aiS+RV:Fy2KPWkf8+FX+NM3Cyt0aiSmV
Static task
static1
Behavioral task
behavioral1
Sample
601ea83a4a3b3ba5037c8185d1b8f521091a9bcc2a1676c6e047518405c91d58.exe
Resource
win10v2004-20231020-en
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Extracted
redline
grome
77.91.124.86:19084
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Targets
-
-
Target
601ea83a4a3b3ba5037c8185d1b8f521091a9bcc2a1676c6e047518405c91d58.exe
-
Size
1.6MB
-
MD5
4134fbef26ed612d274c2beeb721b0b6
-
SHA1
4b7add665f3246c6107d65692a9f6145a1aa579f
-
SHA256
601ea83a4a3b3ba5037c8185d1b8f521091a9bcc2a1676c6e047518405c91d58
-
SHA512
a33d0f9c32ed55a708a28b891d7a5761b17257afbbeecd3cd5702c6ec6ba920d56e9414da282bfda8f7ea20fde0cdb38fe9083167f96da48877bce5c4ec1d668
-
SSDEEP
49152:IMkxML0hUMN3069F5Ienkh8kFOx7P+JskQaCeUvej:7bUU0NIekh8kF8IQZ
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Detect Mystic stealer payload
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1