Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    846e326bf44156b57b223a47574ce383a12a36600d58abc92ad4bffed46647ff.exe

  • Size

    37KB

  • Sample

    240122-ybjgcadbg6

  • MD5

    d0c3e7b04033acd95ef28afbb67f88fe

  • SHA1

    c5c9d57e77969aca2e42d7b644f776be17be27fd

  • SHA256

    846e326bf44156b57b223a47574ce383a12a36600d58abc92ad4bffed46647ff

  • SHA512

    1dcd953cfba7c54bd0a3bd5c58407d1c98c1cd82c43de3039f52d4d36a1310b4705b53fbdb04ae46e7bea9ad2fbe6a36f172018a79b274210377895711a9881a

  • SSDEEP

    384:g0SvEiTbTvpWNcZ0y8fvCv3v3cLkacJEJrAF+rMRTyN/0L+EcoinblneHQM3epz0:jS7TZ38fvCv3E1cUrM+rMRa8Nuq1t

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

0.tcp.eu.ngrok.io:25505

Mutex

afe56b93a28a14c8bcebd0992e16ca71

Attributes
  • reg_key

    afe56b93a28a14c8bcebd0992e16ca71

  • splitter

    |'|'|

Targets

    • Target

      846e326bf44156b57b223a47574ce383a12a36600d58abc92ad4bffed46647ff.exe

    • Size

      37KB

    • MD5

      d0c3e7b04033acd95ef28afbb67f88fe

    • SHA1

      c5c9d57e77969aca2e42d7b644f776be17be27fd

    • SHA256

      846e326bf44156b57b223a47574ce383a12a36600d58abc92ad4bffed46647ff

    • SHA512

      1dcd953cfba7c54bd0a3bd5c58407d1c98c1cd82c43de3039f52d4d36a1310b4705b53fbdb04ae46e7bea9ad2fbe6a36f172018a79b274210377895711a9881a

    • SSDEEP

      384:g0SvEiTbTvpWNcZ0y8fvCv3v3cLkacJEJrAF+rMRTyN/0L+EcoinblneHQM3epz0:jS7TZ38fvCv3E1cUrM+rMRa8Nuq1t

    Score
    8/10
    • Modifies Windows Firewall

    • Drops startup file

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

MITRE ATT&CK Enterprise v15

Tasks