Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    960dce369bf0ee060ce3f5c32589a081075b9ae9123a23ebf69490f4d52f1f26.exe

  • Size

    2.5MB

  • Sample

    240228-velt4aha4s

  • MD5

    23caf06fd127424abe806bf1a94a8074

  • SHA1

    149576b82156776b92a971c6c306a66f36b0b91b

  • SHA256

    960dce369bf0ee060ce3f5c32589a081075b9ae9123a23ebf69490f4d52f1f26

  • SHA512

    b184c1d27befdffc9ffbcff3adbc98e6d1157e6fe2c9a42bcf24ee366f05a81556570e20d1dd0d816d84e72c67be1ba123c42a7b32fac617a2287c1fde561615

  • SSDEEP

    49152:C9JUzBM3/r8AGfg1dk+Y3WOfGRF6qTeEZ/wIwrWpD/t6x:MJKBUGIPk+8HuCqTbwy/tk

Malware Config

Extracted

Family

socks5systemz

C2

http://bhygcvc.com/search/?q=67e28dd86a55a428420bf81f7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f371ea771795af8e05c64bdb22f31df92d8b38e316a667d307eca743ec4c2b07b52966923b6e8ffc18c3ed90

http://ejrcbug.ua/search/?q=67e28dd86c0ea7794406f94d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa44e8889b5e4fa9281ae978f671ea771795af8e05c64bdb22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ef610c3e6969b32

Targets

    • Target

      960dce369bf0ee060ce3f5c32589a081075b9ae9123a23ebf69490f4d52f1f26.exe

    • Size

      2.5MB

    • MD5

      23caf06fd127424abe806bf1a94a8074

    • SHA1

      149576b82156776b92a971c6c306a66f36b0b91b

    • SHA256

      960dce369bf0ee060ce3f5c32589a081075b9ae9123a23ebf69490f4d52f1f26

    • SHA512

      b184c1d27befdffc9ffbcff3adbc98e6d1157e6fe2c9a42bcf24ee366f05a81556570e20d1dd0d816d84e72c67be1ba123c42a7b32fac617a2287c1fde561615

    • SSDEEP

      49152:C9JUzBM3/r8AGfg1dk+Y3WOfGRF6qTeEZ/wIwrWpD/t6x:MJKBUGIPk+8HuCqTbwy/tk

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

    • Detects executables packed with VMProtect.

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks