Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

MerekV3.08_Lite.rar

windows7-x64

4

MerekV3.08_Lite.rar

windows10-2004-x64

7

MerekV3.08...DME.md

windows7-x64

3

MerekV3.08...DME.md

windows10-2004-x64

3

MerekV3.08...10.pyc

windows7-x64

3

MerekV3.08...10.pyc

windows10-2004-x64

3

MerekV3.08...ts.bat

windows7-x64

1

MerekV3.08...ts.bat

windows10-2004-x64

1

MerekV3.08...10.pyc

windows7-x64

3

MerekV3.08...10.pyc

windows10-2004-x64

3

MerekV3.08...bot.py

windows7-x64

3

MerekV3.08...bot.py

windows10-2004-x64

3

MerekV3.08...st.zip

windows7-x64

1

MerekV3.08...st.zip

windows10-2004-x64

1

best/.data...ion_id

windows7-x64

1

best/.data...ion_id

windows10-2004-x64

1

best/byteorder

windows7-x64

1

best/byteorder

windows10-2004-x64

1

best/data.pkl

windows7-x64

3

best/data.pkl

windows10-2004-x64

3

best/data/0

windows7-x64

1

best/data/0

windows10-2004-x64

1

best/data/1

windows7-x64

1

best/data/1

windows10-2004-x64

1

best/data/10

windows7-x64

1

best/data/10

windows10-2004-x64

1

best/data/100

windows7-x64

1

best/data/100

windows10-2004-x64

1

best/data/101

windows7-x64

1

best/data/101

windows10-2004-x64

1

best/data/102

windows7-x64

1

best/data/102

windows10-2004-x64

1

Analysis

  • max time kernel
    90s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/04/2024, 14:41 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    MerekV3.08 Lite/Merek Aimbot/lib/__pycache__/aimbot.cpython-310.pyc

  • Size

    7KB

  • MD5

    1600e4aa01c3395c20c32e50376a8eb8

  • SHA1

    6097a7d5eb71bf374d4b9fd78ed2f4f7497fece8

  • SHA256

    fb3ddedf915a53ca980945bf47c19919ca9715121cc962de3d04fa11be5b5d87

  • SHA512

    8dc852cd6f7edf15d6efa07ac8887ce0c3cfc597fc2bae351acb289b69538dee10b3a320754068a2e04c074df8355a1a5f6ed260afc1459d3b181b1e7831287e

  • SSDEEP

    192:MwL7DLzlxs2eNKSLcJm23DqHpQguEANeLIvjS+zQWe5mwH+jD7OW/NZO9qGP+xO9:Ms7DLzD1eNKSL4yMND/G+KWkq6+09

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\MerekV3.08 Lite\Merek Aimbot\lib\__pycache__\aimbot.cpython-310.pyc"
    1⤵
    • Modifies registry class
    PID:4712
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2040

Network

  • flag-us
    DNS
    13.86.106.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.86.106.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    240.197.17.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.197.17.2.in-addr.arpa
    IN PTR
    Response
    240.197.17.2.in-addr.arpa
    IN PTR
    a2-17-197-240deploystaticakamaitechnologiescom
  • flag-us
    DNS
    0.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    157.123.68.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    157.123.68.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    56.126.166.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    56.126.166.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    28.143.109.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.143.109.104.in-addr.arpa
    IN PTR
    Response
    28.143.109.104.in-addr.arpa
    IN PTR
    a104-109-143-28deploystaticakamaitechnologiescom
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    239.249.30.184.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    239.249.30.184.in-addr.arpa
    IN PTR
    Response
    239.249.30.184.in-addr.arpa
    IN PTR
    a184-30-249-239deploystaticakamaitechnologiescom
  • flag-us
    DNS
    19.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    19.229.111.52.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    13.86.106.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    13.86.106.20.in-addr.arpa

  • 8.8.8.8:53
    240.197.17.2.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    240.197.17.2.in-addr.arpa

  • 8.8.8.8:53
    0.159.190.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    0.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    157.123.68.40.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    157.123.68.40.in-addr.arpa

  • 8.8.8.8:53
    56.126.166.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    56.126.166.20.in-addr.arpa

  • 8.8.8.8:53
    28.143.109.104.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    28.143.109.104.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    239.249.30.184.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    239.249.30.184.in-addr.arpa

  • 8.8.8.8:53
    19.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    19.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.