Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    5b45188cebe24c4309d3d884cb92bc5d9466e9dd8fa57f670b0008931e18562e.exe

  • Size

    93KB

  • Sample

    240122-yar24adbe9

  • MD5

    627d146f44e901aa1bcd48effb3b788f

  • SHA1

    8964f3c422dc04d0e71c7fe8439df4da708eeb3b

  • SHA256

    5b45188cebe24c4309d3d884cb92bc5d9466e9dd8fa57f670b0008931e18562e

  • SHA512

    91c3cb47d136166b11fd64c5efad4ce063197ea42de19dc74c9b557e82ec7b8f15b9dace70891259abd27d0775b8efccf089f34f44586350d383268568ae12c5

  • SSDEEP

    768:lY31Um/o9eUVTsZ4E+rLDPQmJ/ewL54lLdJXn5513Sr2YxgXxrjEtCdnl2pi1RzC:yUeoZp/eM4LvFSrdqjEwzGi1dDcD/gS

Score
10/10

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

0.tcp.eu.ngrok.io:18595

Mutex

919094467c31347c7137dd444837fdc3

Attributes
  • reg_key

    919094467c31347c7137dd444837fdc3

  • splitter

    |'|'|

Targets

    • Target

      5b45188cebe24c4309d3d884cb92bc5d9466e9dd8fa57f670b0008931e18562e.exe

    • Size

      93KB

    • MD5

      627d146f44e901aa1bcd48effb3b788f

    • SHA1

      8964f3c422dc04d0e71c7fe8439df4da708eeb3b

    • SHA256

      5b45188cebe24c4309d3d884cb92bc5d9466e9dd8fa57f670b0008931e18562e

    • SHA512

      91c3cb47d136166b11fd64c5efad4ce063197ea42de19dc74c9b557e82ec7b8f15b9dace70891259abd27d0775b8efccf089f34f44586350d383268568ae12c5

    • SSDEEP

      768:lY31Um/o9eUVTsZ4E+rLDPQmJ/ewL54lLdJXn5513Sr2YxgXxrjEtCdnl2pi1RzC:yUeoZp/eM4LvFSrdqjEwzGi1dDcD/gS

    Score
    8/10
    • Modifies Windows Firewall

    • Drops startup file

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks