Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    0x0006000000015e1b-569.dat

  • Size

    38KB

  • Sample

    231212-m42ylsdch2

  • MD5

    49a331a8ba0b9ffe723b53df3a0eab3e

  • SHA1

    e92d1ddfcfcfe6cd02191126e88b1e5ca6bb2e98

  • SHA256

    d9c0cc0bfc71605c5cb7c609c3de7a5544c50d2d66d049495f17d70b9ea98757

  • SHA512

    78588677d3296e998037362f244aea6e53346da4901237ab086a57b8fa76ec79114002b3470e3e67a461681722bd99c72c70dd36acdb2c15167d58423228acf5

  • SSDEEP

    768:d8n3N4JRqwg8UTB+8zx70f0PSuopLwlFFWO7:dmN4JRrg8ypxSKFFX

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://81.19.131.34/fks/index.php

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

LiveTraffic

C2

77.105.132.87:17066

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

@oleh_ps

C2

176.123.7.190:32927

Targets

    • Target

      0x0006000000015e1b-569.dat

    • Size

      38KB

    • MD5

      49a331a8ba0b9ffe723b53df3a0eab3e

    • SHA1

      e92d1ddfcfcfe6cd02191126e88b1e5ca6bb2e98

    • SHA256

      d9c0cc0bfc71605c5cb7c609c3de7a5544c50d2d66d049495f17d70b9ea98757

    • SHA512

      78588677d3296e998037362f244aea6e53346da4901237ab086a57b8fa76ec79114002b3470e3e67a461681722bd99c72c70dd36acdb2c15167d58423228acf5

    • SSDEEP

      768:d8n3N4JRqwg8UTB+8zx70f0PSuopLwlFFWO7:dmN4JRrg8ypxSKFFX

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Downloads MZ/PE file

    • Modifies Windows Firewall

    • Deletes itself

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks