Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
c80ad95d8919aed655678551a709650ce2f818ceed020fe63e5d89e0fc0b11f8
-
Size
2.2MB
-
Sample
231211-whsx9afbf2
-
MD5
ab65d23790b08a6ee93cdbe9ba1a418e
-
SHA1
f16fc80cf64591580059a348c3aec209e97684c9
-
SHA256
c80ad95d8919aed655678551a709650ce2f818ceed020fe63e5d89e0fc0b11f8
-
SHA512
34c8ad5242f62a268974a42f42ed2b5ba4da522aa8c4847dc8b94b16b089f9ab274f8cbbffa722e5478ae02f2f272dddee4aa0cd024fd6990329345a8ce21e1a
-
SSDEEP
49152:WBRvbeL8ouTPJ+Xbx2l0EYfoSvTIOHm/bCMP9eQTSVnXRxumcj4hD:QbSurJ+El0EY/bFLMFe8SVhrU4h
Static task
static1
Behavioral task
behavioral1
Sample
c80ad95d8919aed655678551a709650ce2f818ceed020fe63e5d89e0fc0b11f8.exe
Resource
win10-20231023-en
Malware Config
Extracted
risepro
193.233.132.51
Extracted
smokeloader
2022
http://81.19.131.34/fks/index.php
Extracted
smokeloader
up3
Targets
-
-
Target
c80ad95d8919aed655678551a709650ce2f818ceed020fe63e5d89e0fc0b11f8
-
Size
2.2MB
-
MD5
ab65d23790b08a6ee93cdbe9ba1a418e
-
SHA1
f16fc80cf64591580059a348c3aec209e97684c9
-
SHA256
c80ad95d8919aed655678551a709650ce2f818ceed020fe63e5d89e0fc0b11f8
-
SHA512
34c8ad5242f62a268974a42f42ed2b5ba4da522aa8c4847dc8b94b16b089f9ab274f8cbbffa722e5478ae02f2f272dddee4aa0cd024fd6990329345a8ce21e1a
-
SSDEEP
49152:WBRvbeL8ouTPJ+Xbx2l0EYfoSvTIOHm/bCMP9eQTSVnXRxumcj4hD:QbSurJ+El0EY/bFLMFe8SVhrU4h
-
Detect ZGRat V1
-
Glupteba payload
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Downloads MZ/PE file
-
Drops startup file
-
Executes dropped EXE
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1