Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    SecuriteInfo.com.Win32.DropperX-gen.27062.13281.exe

  • Size

    1.6MB

  • Sample

    240124-zapgmsgghp

  • MD5

    39ad433c9ba920e7fd0961c66ac7079e

  • SHA1

    8a54961347eab2253e2004e33f399c4cd07c8577

  • SHA256

    e1471b0576c26d33b4fda732a7e0aba43193849ef1de6bbcdd42e8724354dd00

  • SHA512

    676da03f46446ad3a6e83e7b0d6648e6c82e25d0866fbe13f85ea0a3ec6ffb9fb507b28ae69638a4cf62d51b0aefb934bd20d77605a78d1f8652ef2fd5d38b71

  • SSDEEP

    24576:iyB7eQVOovzwkKEFL3WlrpY7Gv1eeajEja3KgffHCx2GwV/6ltVIaH3:D9VmuL3WZ7vcVjEvGHaKViFJ3

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.oripam.xyz
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    231Father@

Targets

    • Target

      SecuriteInfo.com.Win32.DropperX-gen.27062.13281.exe

    • Size

      1.6MB

    • MD5

      39ad433c9ba920e7fd0961c66ac7079e

    • SHA1

      8a54961347eab2253e2004e33f399c4cd07c8577

    • SHA256

      e1471b0576c26d33b4fda732a7e0aba43193849ef1de6bbcdd42e8724354dd00

    • SHA512

      676da03f46446ad3a6e83e7b0d6648e6c82e25d0866fbe13f85ea0a3ec6ffb9fb507b28ae69638a4cf62d51b0aefb934bd20d77605a78d1f8652ef2fd5d38b71

    • SSDEEP

      24576:iyB7eQVOovzwkKEFL3WlrpY7Gv1eeajEja3KgffHCx2GwV/6ltVIaH3:D9VmuL3WZ7vcVjEvGHaKViFJ3

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Detect ZGRat V1

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • ModiLoader Second Stage

    • Creates new service(s)

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks