Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
22ee5170ef8d6b5f7d2ac21ddd41b62b8ef5ba77fa8093f552278182afb45a5d
-
Size
1.8MB
-
Sample
240405-aydbvaff87
-
MD5
d22ac552bde50aec908a505ab37377b6
-
SHA1
c5f7d3f19293ffa045aec238704e0417bafd5261
-
SHA256
22ee5170ef8d6b5f7d2ac21ddd41b62b8ef5ba77fa8093f552278182afb45a5d
-
SHA512
1d8467c41fbe7126b4a8b8472219b173dcecde20427fed7c34df1ad9f9fb064b67fe913b0f3c06ab2e2363720d3e8a53d3cedf7df7424ad4be6ae317d1bb8cca
-
SSDEEP
49152:HPMWECeSMTZQli5qxC01Z/qX/AubYCm/Faszje:HtECe7ZPqY0youbFm/Ms
Static task
static1
Behavioral task
behavioral1
Sample
22ee5170ef8d6b5f7d2ac21ddd41b62b8ef5ba77fa8093f552278182afb45a5d.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
22ee5170ef8d6b5f7d2ac21ddd41b62b8ef5ba77fa8093f552278182afb45a5d.exe
Resource
win11-20240221-en
Malware Config
Extracted
amadey
4.17
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
redline
Jok123
185.215.113.67:26260
Extracted
redline
@OLEH_PSP
185.172.128.33:8970
Extracted
redline
LiveTraffic
4.185.137.132:1632
Targets
-
-
Target
22ee5170ef8d6b5f7d2ac21ddd41b62b8ef5ba77fa8093f552278182afb45a5d
-
Size
1.8MB
-
MD5
d22ac552bde50aec908a505ab37377b6
-
SHA1
c5f7d3f19293ffa045aec238704e0417bafd5261
-
SHA256
22ee5170ef8d6b5f7d2ac21ddd41b62b8ef5ba77fa8093f552278182afb45a5d
-
SHA512
1d8467c41fbe7126b4a8b8472219b173dcecde20427fed7c34df1ad9f9fb064b67fe913b0f3c06ab2e2363720d3e8a53d3cedf7df7424ad4be6ae317d1bb8cca
-
SSDEEP
49152:HPMWECeSMTZQli5qxC01Z/qX/AubYCm/Faszje:HtECe7ZPqY0youbFm/Ms
-
Detect ZGRat V1
-
Glupteba payload
-
Modifies firewall policy service
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Modifies Windows Firewall
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
7Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1