Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

yofgvjmxzl...fm.exe

windows7-x64

5

yofgvjmxzl...fm.exe

windows10-2004-x64

10

yofgvjmxzl...fm.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    yofgvjmxzlhk.zip

  • Size

    6.1MB

  • Sample

    240421-j4ge5afb8t

  • MD5

    32e96854dc7647c6c82eef7c1a5d6389

  • SHA1

    86a90d7d46700c48df610bd6bf3844a9874042f1

  • SHA256

    deb74a8c97121df31c8d1ba30b32cc89e94ec58e43d0ea2036b39bdec13e3cae

  • SHA512

    60bc3e13e5919256379db2dce33b883ea5f7cf1e2e9f48e770140c5c18c1799d1cb3d1363b9d9c80a5be4a1fd7ed70b79faecb4e9c3e828ae8f357c796bcc884

  • SSDEEP

    196608:iYLnwHUt0lma3+h9I7NK1CgfczIndmIYwkX/:iYGUt00aOheIHcz2dmIY3v

Score
10/10
xmrigevasionminerpersistence

Malware Config

Targets

    • Target

      yofgvjmxzlhk/qrehadfoimfm.exe

    • Size

      798.9MB

    • MD5

      b83bcfb29a3afb45d53982e18527e251

    • SHA1

      93e5f9eb9cad46182b3b0201ecf3fbe7b02af0b0

    • SHA256

      f0eedc95c8eeefa8d05ae3bf0fd002ac1a1e1f2a4e6c93e5f0638f9a6f8226bd

    • SHA512

      7fb30cbd086bb196b4f200d6fedfd440d358e6f2bce5c0c37a82a2a04790ecd892e74ded78dc0c6cd861e51ff9e472f2c2780bb63c74579b2afb980cf56b2722

    • SSDEEP

      196608:JS2bBkpkL2bw+tEBVMDLAFCChInihn+skk6fw:02kkL2s+GBGgJInen+skLI

    Score
    10/10
    xmrigevasionminerpersistence

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Creates new service(s)

      persistence

    • Stops running service(s)

      evasion

    • Executes dropped EXE

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v15

Tasks