Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    ca53d2999d03224645aa0286d276d5f546a1651b09525463f1a4c9ae5214c44c

  • Size

    1.8MB

  • Sample

    240415-a65fascg5w

  • MD5

    6494e2a481a49e8ccf7faedabdf340e7

  • SHA1

    78800e726a00b45f291456b11388d7007f8c5d65

  • SHA256

    ca53d2999d03224645aa0286d276d5f546a1651b09525463f1a4c9ae5214c44c

  • SHA512

    697a146ef7dd9a1d20242d8d45724ad8e59a80fc91814a2015481a7794ade56a9e7a1b6391be659397b91500a49db00d47d90925a45ed427801ba1f321f1c20d

  • SSDEEP

    24576:r8etaVzAJSZG9sj+BhL2pEHdOLqAJrWwH6tUXnfVMtktOuXsglvMhFv:roVzAJT/vHdVARWwatMfYwbYv

Malware Config

Extracted

Family

amadey

Version

4.17

C2

http://185.215.113.32

Attributes
  • install_dir

    00c07260dc

  • install_file

    explorgu.exe

  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain
1
006700e5a2ab05704bbb0c589b88924d

Extracted

Family

redline

Botnet

@OLEH_PSP

C2

185.172.128.33:8970

Extracted

Family

stealc

C2

http://52.143.157.84

Attributes
  • url_path

    /c73eed764cc59dcb.php

Extracted

Family

risepro

C2

147.45.47.93:58709

Targets

    • Target

      ca53d2999d03224645aa0286d276d5f546a1651b09525463f1a4c9ae5214c44c

    • Size

      1.8MB

    • MD5

      6494e2a481a49e8ccf7faedabdf340e7

    • SHA1

      78800e726a00b45f291456b11388d7007f8c5d65

    • SHA256

      ca53d2999d03224645aa0286d276d5f546a1651b09525463f1a4c9ae5214c44c

    • SHA512

      697a146ef7dd9a1d20242d8d45724ad8e59a80fc91814a2015481a7794ade56a9e7a1b6391be659397b91500a49db00d47d90925a45ed427801ba1f321f1c20d

    • SSDEEP

      24576:r8etaVzAJSZG9sj+BhL2pEHdOLqAJrWwH6tUXnfVMtktOuXsglvMhFv:roVzAJT/vHdVARWwatMfYwbYv

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Detect ZGRat V1

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

    • Stealc

      Stealc is an infostealer written in C++.

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Creates new service(s)

    • Downloads MZ/PE file

    • Stops running service(s)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.