Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2fb7fc0949aa14070e5e5d1ec37d48e7.exe
-
Size
65KB
-
Sample
240405-vydylahh4w
-
MD5
2fb7fc0949aa14070e5e5d1ec37d48e7
-
SHA1
9b0043790d9881f690e11086004d3218648d9c22
-
SHA256
246ab25a7240d684c1a6bf5abd6bcd6f13e0d86c97940883bc249e2b7cb23853
-
SHA512
13a475df0962a72f8c817511dbda22efb07c41167ebac229c7b0193a88c0f6bf383025e1327732b152d8a53ab4358d4b40d3c6f4b09cc3881165bda826e16f3b
-
SSDEEP
1536:FIkoUoN36tSQviFw1gnRuBnvbLfLteF3nLrB9z3nNaF9bIS9vM:FIkoUoN36tSQviFC08BnHfWl9zdaF9bw
Behavioral task
behavioral1
Sample
2fb7fc0949aa14070e5e5d1ec37d48e7.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
2fb7fc0949aa14070e5e5d1ec37d48e7.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
njrat
Platinum
HacKed
127.0.0.1:11964
Exspa.exe
-
reg_key
Exspa.exe
-
splitter
|Ghost|
Targets
-
-
Target
2fb7fc0949aa14070e5e5d1ec37d48e7.exe
-
Size
65KB
-
MD5
2fb7fc0949aa14070e5e5d1ec37d48e7
-
SHA1
9b0043790d9881f690e11086004d3218648d9c22
-
SHA256
246ab25a7240d684c1a6bf5abd6bcd6f13e0d86c97940883bc249e2b7cb23853
-
SHA512
13a475df0962a72f8c817511dbda22efb07c41167ebac229c7b0193a88c0f6bf383025e1327732b152d8a53ab4358d4b40d3c6f4b09cc3881165bda826e16f3b
-
SSDEEP
1536:FIkoUoN36tSQviFw1gnRuBnvbLfLteF3nLrB9z3nNaF9bIS9vM:FIkoUoN36tSQviFC08BnHfWl9zdaF9bw
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-