Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    4648d0a5e582bf40719a470d7780d0a0_NEIKI

  • Size

    4.2MB

  • Sample

    240507-1v17lshh9w

  • MD5

    4648d0a5e582bf40719a470d7780d0a0

  • SHA1

    8f10a69dc623dc1e0242a02d1664bd3b82af92ac

  • SHA256

    f7b85638ee513039e046200e2fb4773adf387250e9f9878adca73e668b2ac434

  • SHA512

    4345b217fb1bc60c44a48d981f26fa06ed413cc21f9a4a019340dc33083ab52967924d931f980a9566e1b3e828935dcfc6626b5362d12952126fbd0915fe75f2

  • SSDEEP

    98304:PuG3QFxSNkN4u615vkopeNoVxTRrGDAQtoqh8RdhB:PuIxyNs5vbp4oV5VPa8Rdj

Malware Config

Targets

    • Target

      4648d0a5e582bf40719a470d7780d0a0_NEIKI

    • Size

      4.2MB

    • MD5

      4648d0a5e582bf40719a470d7780d0a0

    • SHA1

      8f10a69dc623dc1e0242a02d1664bd3b82af92ac

    • SHA256

      f7b85638ee513039e046200e2fb4773adf387250e9f9878adca73e668b2ac434

    • SHA512

      4345b217fb1bc60c44a48d981f26fa06ed413cc21f9a4a019340dc33083ab52967924d931f980a9566e1b3e828935dcfc6626b5362d12952126fbd0915fe75f2

    • SSDEEP

      98304:PuG3QFxSNkN4u615vkopeNoVxTRrGDAQtoqh8RdhB:PuIxyNs5vbp4oV5VPa8Rdj

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Windows security bypass

    • Modifies boot configuration data using bcdedit

    • Drops file in Drivers directory

    • Modifies Windows Firewall

    • Possible attempt to disable PatchGuard

      Rootkits can use kernel patching to embed themselves in an operating system.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Windows security modification

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Manipulates WinMon driver.

      Roottkits write to WinMon to hide PIDs from being detected.

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks