Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
863f7d8977770a3205032aaae73ced8918610e914645d62df45ab0c2a7d05075
-
Size
1.8MB
-
Sample
240504-ackh2agg9t
-
MD5
5aa9b6551af09e1b7e91b1b9cf8fc6f1
-
SHA1
2274b0e20c404a0d92890e3f15997c5ba676493a
-
SHA256
863f7d8977770a3205032aaae73ced8918610e914645d62df45ab0c2a7d05075
-
SHA512
ff78f86202f7b00165ea0bc45d74d35c4f01c52b24f29a466b6cac9527c5538521734a96d52cf906bd82469ed0cdb13afdc4acc725fe1260a3d4e09944eb3939
-
SSDEEP
49152:stUIGkWGJncPze8IdI7FmWhderKvCf6wF:stUr4kX7Fm3rKwTF
Static task
static1
Behavioral task
behavioral1
Sample
863f7d8977770a3205032aaae73ced8918610e914645d62df45ab0c2a7d05075.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
863f7d8977770a3205032aaae73ced8918610e914645d62df45ab0c2a7d05075.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
amadey
4.18
http://193.233.132.56
-
install_dir
09fd851a4f
-
install_file
explorha.exe
-
strings_key
443351145ece4966ded809641c77cfa8
-
url_paths
/Pneh2sXQk0/index.php
Extracted
asyncrat
| Edit 3LOSH RAT
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
45.61.150.201:6606
45.61.150.201:7707
45.61.150.201:8808
beshomandotestbesnd.run.place:6606
beshomandotestbesnd.run.place:7707
beshomandotestbesnd.run.place:8808
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_file
mstc.exe
-
install_folder
%AppData%
Extracted
xworm
5.0
127.0.0.1:7000
45.61.150.201:7000
beshomandotestbesnd.run.place:7000
yolgBkNEg1jvKfWQ
-
Install_directory
%AppData%
-
install_file
XClient.exe
-
telegram
https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672
Extracted
redline
Test1234
185.215.113.67:26260
Extracted
stealc
http://52.143.157.84
http://185.172.128.150
-
url_path
/c73eed764cc59dcb.php
Extracted
redline
@CLOUDYTTEAM
185.172.128.33:8970
Extracted
lumma
https://affordcharmcropwo.shop/api
https://cleartotalfisherwo.shop/api
https://worryfillvolcawoi.shop/api
https://enthusiasimtitleow.shop/api
https://dismissalcylinderhostw.shop/api
https://diskretainvigorousiw.shop/api
https://communicationgenerwo.shop/api
https://pillowbrocccolipe.shop/api
https://incredibleextedwj.shop/api
https://productivelookewr.shop/api
https://zippyfinickysofwps.shop/api
https://tolerateilusidjukl.shop/api
https://obsceneclassyjuwks.shop/api
https://miniaturefinerninewjs.shop/api
https://alcojoldwograpciw.shop/api
https://plaintediousidowsko.shop/api
https://liabilitynighstjsko.shop/api
https://sweetsquarediaslw.shop/api
https://demonstationfukewko.shop/api
https://holicisticscrarws.shop/api
https://boredimperissvieos.shop/api
Targets
-
-
Target
863f7d8977770a3205032aaae73ced8918610e914645d62df45ab0c2a7d05075
-
Size
1.8MB
-
MD5
5aa9b6551af09e1b7e91b1b9cf8fc6f1
-
SHA1
2274b0e20c404a0d92890e3f15997c5ba676493a
-
SHA256
863f7d8977770a3205032aaae73ced8918610e914645d62df45ab0c2a7d05075
-
SHA512
ff78f86202f7b00165ea0bc45d74d35c4f01c52b24f29a466b6cac9527c5538521734a96d52cf906bd82469ed0cdb13afdc4acc725fe1260a3d4e09944eb3939
-
SSDEEP
49152:stUIGkWGJncPze8IdI7FmWhderKvCf6wF:stUr4kX7Fm3rKwTF
-
Detect Xworm Payload
-
Detect ZGRat V1
-
Glupteba payload
-
Modifies firewall policy service
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Async RAT payload
-
Detect binaries embedding considerable number of MFA browser extension IDs.
-
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
-
Detects Windows executables referencing non-Windows User-Agents
-
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
-
Detects encrypted or obfuscated .NET executables
-
Detects executables (downlaoders) containing URLs to raw contents of a paste
-
Detects executables Discord URL observed in first stage droppers
-
Detects executables containing URLs to raw contents of a Github gist
-
Detects executables containing artifacts associated with disabling Widnows Defender
-
Detects executables packed with SmartAssembly
-
Detects executables packed with Themida
-
Detects executables packed with VMProtect.
-
Detects executables packed with or use KoiVM
-
Detects executables referencing many varying, potentially fake Windows User-Agents
-
Detects executables using Telegram Chat Bot
-
Detects file containing reversed ASEP Autorun registry keys
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Modifies Windows Firewall
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
2PowerShell
2Scheduled Task/Job
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
5Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
7Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1