Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    0x0006000000023286-3800.dat

  • Size

    38KB

  • Sample

    231211-ry8anahdgq

  • MD5

    f874f242a30d6873edb7eaf2db40cbdb

  • SHA1

    5a162d4052d569aebcff2432f62c43ffb2867fee

  • SHA256

    ffee6552e3258166c9ef418c12f67d1167cf7dc9abb29b8d4e49056607ff2c0f

  • SHA512

    a52e1f03ca548f3118f3a8b8c7bd2493f16358b6e6c6b7619f5cb05596f7c02fe178b150c7f558dce1a7f19327cf21b3cc85932ccdeab2ac5dda1f7192b608b0

  • SSDEEP

    768:d8n3N4JRqwg8UTB+8zx70f0PSuopLwlFFWO7:dmN4JRrg8ypxSKFFX

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://81.19.131.34/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

@oleh_ps

C2

176.123.7.190:32927

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Targets

    • Target

      0x0006000000023286-3800.dat

    • Size

      38KB

    • MD5

      f874f242a30d6873edb7eaf2db40cbdb

    • SHA1

      5a162d4052d569aebcff2432f62c43ffb2867fee

    • SHA256

      ffee6552e3258166c9ef418c12f67d1167cf7dc9abb29b8d4e49056607ff2c0f

    • SHA512

      a52e1f03ca548f3118f3a8b8c7bd2493f16358b6e6c6b7619f5cb05596f7c02fe178b150c7f558dce1a7f19327cf21b3cc85932ccdeab2ac5dda1f7192b608b0

    • SSDEEP

      768:d8n3N4JRqwg8UTB+8zx70f0PSuopLwlFFWO7:dmN4JRrg8ypxSKFFX

    • Detect ZGRat V1

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Downloads MZ/PE file

    • Modifies Windows Firewall

    • Deletes itself

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks