Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    c68dd6becf7ff5f43ae83924cd67613c

  • Size

    3.3MB

  • Sample

    240313-wwr8waea34

  • MD5

    c68dd6becf7ff5f43ae83924cd67613c

  • SHA1

    2f95861167f6fc5dc9b9ae46460b052fa789e73f

  • SHA256

    3df4f87d41a548e7cd16ee0bd11ce89e6c74681ca2d5741eed38238a91d5f415

  • SHA512

    832bc830f2728dd9b6509d39c092ff123ef85e58367eba9c0c55c0ec3d0e6194ee37c090dfc6638f5fb05151447ee3fee6c38f1818baaafc3be2e856cf55e846

  • SSDEEP

    98304:xqj4BFusRGZRQCgaTf0tRy/SdDXsZ1iCvLUBsK5n:xsVZLERFdAZ1TLUCKp

Malware Config

Extracted

Family

nullmixer

C2

http://watira.xyz/

Extracted

Family

smokeloader

Botnet

pub5

Extracted

Family

vidar

Version

39.8

Botnet

706

C2

https://xeronxikxxx.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

redline

Botnet

AniOLD

C2

liezaphare.xyz:80

Extracted

Family

smokeloader

Version

2020

C2

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/

rc4.i32
rc4.i32

Targets

    • Target

      c68dd6becf7ff5f43ae83924cd67613c

    • Size

      3.3MB

    • MD5

      c68dd6becf7ff5f43ae83924cd67613c

    • SHA1

      2f95861167f6fc5dc9b9ae46460b052fa789e73f

    • SHA256

      3df4f87d41a548e7cd16ee0bd11ce89e6c74681ca2d5741eed38238a91d5f415

    • SHA512

      832bc830f2728dd9b6509d39c092ff123ef85e58367eba9c0c55c0ec3d0e6194ee37c090dfc6638f5fb05151447ee3fee6c38f1818baaafc3be2e856cf55e846

    • SSDEEP

      98304:xqj4BFusRGZRQCgaTf0tRy/SdDXsZ1iCvLUBsK5n:xsVZLERFdAZ1TLUCKp

    • Detect Fabookie payload

    • Fabookie

      Fabookie is facebook account info stealer.

    • NullMixer

      NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

    • SectopRAT

      SectopRAT is a remote access trojan first seen in November 2019.

    • SectopRAT payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Nirsoft

    • Vidar Stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks