Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://cdn.discorda...

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    https://cdn.discordapp.com/attachments/1211065081018978314/1211067374950809700/Gold_Loader_Fix_for_Failed_to_Manual_Map.exe?ex=65ecd962&is=65da6462&hm=e479038f7b337707a00c24e5082fa1fb3938e129f22bc5481b607184abceee2f&

  • Sample

    240224-1r9pksgb7t

Score
10/10
xwormzgratpersistencerattrojan

Malware Config

Targets

    • Target

      https://cdn.discordapp.com/attachments/1211065081018978314/1211067374950809700/Gold_Loader_Fix_for_Failed_to_Manual_Map.exe?ex=65ecd962&is=65da6462&hm=e479038f7b337707a00c24e5082fa1fb3938e129f22bc5481b607184abceee2f&

    Score
    10/10
    xwormzgratpersistencerattrojan

    • Detect Xworm Payload

    • Detect ZGRat V1

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Downloads MZ/PE file

    • .NET Reactor proctector

      Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks