Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Unconfirmed 846349.crdownload

  • Size

    17.7MB

  • Sample

    231228-2drsaaefbp

  • MD5

    fd612c4672f2586b4aa55d89a2a9f90f

  • SHA1

    3d56149753ba8751dd075bd005d3e0e24010f7db

  • SHA256

    dd3557fc56f0285c9fa616a63504db6235816e1b37b1ea2583d11220f55638ac

  • SHA512

    e56f1438e3a4f58f6fdf0fa6521e05daca4b51b5e0c0713388d6e4c3a7b8eed632f15c00de813bfc625310d57e5ab2966add29771beb1627d4721c708f24aefb

  • SSDEEP

    393216:mqPnLFXlreQpDOETgsvfGaNgmMXTvE84NrQL3q:LPLFXNeQoEJhMovrG6

Malware Config

Targets

    • Target

      Unconfirmed 846349.crdownload

    • Size

      17.7MB

    • MD5

      fd612c4672f2586b4aa55d89a2a9f90f

    • SHA1

      3d56149753ba8751dd075bd005d3e0e24010f7db

    • SHA256

      dd3557fc56f0285c9fa616a63504db6235816e1b37b1ea2583d11220f55638ac

    • SHA512

      e56f1438e3a4f58f6fdf0fa6521e05daca4b51b5e0c0713388d6e4c3a7b8eed632f15c00de813bfc625310d57e5ab2966add29771beb1627d4721c708f24aefb

    • SSDEEP

      393216:mqPnLFXlreQpDOETgsvfGaNgmMXTvE84NrQL3q:LPLFXNeQoEJhMovrG6

    Score
    7/10
    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Target

      main.pyc

    • Size

      7KB

    • MD5

      f32ca5a89e7be9db00d04c4ed6d38179

    • SHA1

      882665189c6272c5b88a0fa8d74051545f62da5e

    • SHA256

      18c2475b296d0ec589234e7912ecbd10c1a9405abf0144310ca911cf32a97d80

    • SHA512

      d4c00284ccebe08fc1ff2734de5794c6579b6637d13e28dd69b0add46ca920759ad4af05297db1b3a4d9508c88549229ece40165cf3329598f8b2a750327b1bf

    • SSDEEP

      192:w/C7L+KD8gpemWdXw54eqhD4k27Jhw30tkMdw0nw:B7CcvWu5tpd23QkP0w

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks