Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    17d50afa15010ac32d812c5dcf92ecc7ea092b211dbaf615cff598b23443d3fe

  • Size

    4.2MB

  • Sample

    240501-tzlt6abb6t

  • MD5

    bcd023b39f1143fb8a92f7c3f8ef9d35

  • SHA1

    1bebb58a15d5ce9290a29c58a179439649bf582b

  • SHA256

    17d50afa15010ac32d812c5dcf92ecc7ea092b211dbaf615cff598b23443d3fe

  • SHA512

    4801b6c94b106afe728ba76b3cc049d03a6a269efb8a88c8b848a8309cb269ccd974057c9d0a95fb3f337a72fd2908ab0c0b49d17741ad4a69b130dbe1512003

  • SSDEEP

    98304:l/JQ0p3x8E8SPoR4RNZx2D64gtjtYEI4STUr/55MSjo:l/JQ0pqEXPoR4RvU1gjYEIpeBOd

Malware Config

Targets

    • Target

      17d50afa15010ac32d812c5dcf92ecc7ea092b211dbaf615cff598b23443d3fe

    • Size

      4.2MB

    • MD5

      bcd023b39f1143fb8a92f7c3f8ef9d35

    • SHA1

      1bebb58a15d5ce9290a29c58a179439649bf582b

    • SHA256

      17d50afa15010ac32d812c5dcf92ecc7ea092b211dbaf615cff598b23443d3fe

    • SHA512

      4801b6c94b106afe728ba76b3cc049d03a6a269efb8a88c8b848a8309cb269ccd974057c9d0a95fb3f337a72fd2908ab0c0b49d17741ad4a69b130dbe1512003

    • SSDEEP

      98304:l/JQ0p3x8E8SPoR4RNZx2D64gtjtYEI4STUr/55MSjo:l/JQ0pqEXPoR4RvU1gjYEIpeBOd

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Modifies Windows Firewall

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks