Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
96e5c68fffb42920fde28e8f2c94579e8628130f5a6764f3b899c5aa95af6292
-
Size
1.8MB
-
Sample
240506-vlq3dsed22
-
MD5
4a5a212d78ffc9c69da2284b460f459b
-
SHA1
15f2bc513f2ae5183352dd56e801b163d22c6a1d
-
SHA256
96e5c68fffb42920fde28e8f2c94579e8628130f5a6764f3b899c5aa95af6292
-
SHA512
196f39277d39250d7cc3519d14f11f4aaca2b74c0018ef3736a62db3b27e7141dc19f668f754f92718371ea3617b1a2193c0df46362f910fe475763c6eb2d5b1
-
SSDEEP
49152:ag/AZIhLzMgmz7J6qogg/ULkcmEX0vMo0ZA15h0uMdyAYMz7g:ag/AmhLzMgm4qogg6CEX0F90uMd7s
Static task
static1
Behavioral task
behavioral1
Sample
96e5c68fffb42920fde28e8f2c94579e8628130f5a6764f3b899c5aa95af6292.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
amadey
4.18
http://193.233.132.56
-
install_dir
09fd851a4f
-
install_file
explorha.exe
-
strings_key
443351145ece4966ded809641c77cfa8
-
url_paths
/Pneh2sXQk0/index.php
Extracted
redline
Test1234
185.215.113.67:26260
Extracted
stealc
http://52.143.157.84
http://185.172.128.150
-
url_path
/c73eed764cc59dcb.php
Extracted
amadey
4.18
http://193.233.132.56
-
strings_key
443351145ece4966ded809641c77cfa8
-
url_paths
/Pneh2sXQk0/index.php
Extracted
redline
@CLOUDYTTEAM
185.172.128.33:8970
Extracted
lumma
https://affordcharmcropwo.shop/api
https://cleartotalfisherwo.shop/api
https://worryfillvolcawoi.shop/api
https://enthusiasimtitleow.shop/api
https://dismissalcylinderhostw.shop/api
https://diskretainvigorousiw.shop/api
https://communicationgenerwo.shop/api
https://pillowbrocccolipe.shop/api
https://zippyfinickysofwps.shop/api
https://acceptabledcooeprs.shop/api
https://obsceneclassyjuwks.shop/api
https://miniaturefinerninewjs.shop/api
https://plaintediousidowsko.shop/api
https://sweetsquarediaslw.shop/api
https://holicisticscrarws.shop/api
https://boredimperissvieos.shop/api
Targets
-
-
Target
96e5c68fffb42920fde28e8f2c94579e8628130f5a6764f3b899c5aa95af6292
-
Size
1.8MB
-
MD5
4a5a212d78ffc9c69da2284b460f459b
-
SHA1
15f2bc513f2ae5183352dd56e801b163d22c6a1d
-
SHA256
96e5c68fffb42920fde28e8f2c94579e8628130f5a6764f3b899c5aa95af6292
-
SHA512
196f39277d39250d7cc3519d14f11f4aaca2b74c0018ef3736a62db3b27e7141dc19f668f754f92718371ea3617b1a2193c0df46362f910fe475763c6eb2d5b1
-
SSDEEP
49152:ag/AZIhLzMgmz7J6qogg/ULkcmEX0vMo0ZA15h0uMdyAYMz7g:ag/AmhLzMgm4qogg6CEX0F90uMd7s
-
Detect ZGRat V1
-
Glupteba payload
-
Modifies firewall policy service
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Modifies Windows Firewall
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1System Services
1Service Execution
1Persistence
Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
5Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Unsecured Credentials
3Credentials In Files
2Credentials in Registry
1