Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    5c4d929f90342a1c19f11253e884490ed5cf14fc4f31f772c92097dc62169792

  • Size

    4.9MB

  • Sample

    240107-19fjfsfdbn

  • MD5

    128336fc5848c43484a2d28800a7ab39

  • SHA1

    7f986fa0926c17166dfc69c1bca76d6bb52a07c2

  • SHA256

    5c4d929f90342a1c19f11253e884490ed5cf14fc4f31f772c92097dc62169792

  • SHA512

    7a3702c3452c994403e3da938a8486191d68f9417ec1d0fb2d29e0260d0cd3cfecfa4f14f1ccb81be7bf283b4dbe54df4c551a0ac84c57f7aa5699d8feaf52f9

  • SSDEEP

    49152:JLSOMmC3NTiA/vtm228spvc5kY7ZPR6cYuBe52I+Dh/aTjr9N3/AdylBzLFlp05m:JLSOygA/TmiW5RPr9iktlp0T+R0TL2

Malware Config

Targets

    • Target

      5c4d929f90342a1c19f11253e884490ed5cf14fc4f31f772c92097dc62169792

    • Size

      4.9MB

    • MD5

      128336fc5848c43484a2d28800a7ab39

    • SHA1

      7f986fa0926c17166dfc69c1bca76d6bb52a07c2

    • SHA256

      5c4d929f90342a1c19f11253e884490ed5cf14fc4f31f772c92097dc62169792

    • SHA512

      7a3702c3452c994403e3da938a8486191d68f9417ec1d0fb2d29e0260d0cd3cfecfa4f14f1ccb81be7bf283b4dbe54df4c551a0ac84c57f7aa5699d8feaf52f9

    • SSDEEP

      49152:JLSOMmC3NTiA/vtm228spvc5kY7ZPR6cYuBe52I+Dh/aTjr9N3/AdylBzLFlp05m:JLSOygA/TmiW5RPr9iktlp0T+R0TL2

    • Detect ZGRat V1

    • Detects Arechclient2 RAT

      Arechclient2.

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Drops startup file

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks