Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
14351f4eea5fe2e7b23daabf3b3790a8ff76cc674bf3753e0311acd156cd8022.zip
-
Size
1.5MB
-
Sample
240402-ma7l1afa93
-
MD5
b89806765421af42c991a6f60f0f96f9
-
SHA1
7461643a8a4c17ca6607564ce4bb1ad512eb1148
-
SHA256
e2eda24a81cc5892eb37e2fbb2c3a90e3f50bd6eb601ec89132da8bb25ee0259
-
SHA512
b204ecf3256fbb2b74e50053cc76af82bf0b3fb31bc29500db2ef372c189bfd88d3a72acb1f05aaaba49825670e0da25fa4577bcb4c12a1f9a32510692a97fa5
-
SSDEEP
24576:/gGKUHkgaZuUauw/cQl9PpEm9UAsxYxTBvg5jRb5NXCGxJW3OuN3E6IQG8S:/1xEZYP/cQvhEm9U16oNRb54GxJW3pil
Static task
static1
Behavioral task
behavioral1
Sample
14351f4eea5fe2e7b23daabf3b3790a8ff76cc674bf3753e0311acd156cd8022.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Extracted
redline
grome
77.91.124.86:19084
Extracted
amadey
3.89
http://77.91.124.1
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
-
url_paths
/theme/index.php
Targets
-
-
Target
14351f4eea5fe2e7b23daabf3b3790a8ff76cc674bf3753e0311acd156cd8022.exe
-
Size
1.5MB
-
MD5
e09e587871adc5405480db21f770adc6
-
SHA1
3f4f532ff2eb6f3c47b0fa0c1326c562dcd0bc94
-
SHA256
14351f4eea5fe2e7b23daabf3b3790a8ff76cc674bf3753e0311acd156cd8022
-
SHA512
5a80d9fdf45b9fbc102f3a3e5b3017f37668e091fb9f774b1e134eea3779f70b9117d258cdc95ff54e3fe4204c4d722e0599e3d9148345867acdacaceddd8c4b
-
SSDEEP
49152:9tChPo82I9yZsy8CmYwkU9vyqis1auyedW:/ChPokCsJCxsG
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Detect Mystic stealer payload
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1