Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    f900059b568c573369251b4396dbd6779c0eafb5f7eed91848a1281751135d78

  • Size

    163KB

  • Sample

    240508-fasphsdh42

  • MD5

    eacbb8fbbde17e2f7c3f503b04ac1bcf

  • SHA1

    cb32f4c7d0a318d8779b84f402f6824707822fb3

  • SHA256

    f900059b568c573369251b4396dbd6779c0eafb5f7eed91848a1281751135d78

  • SHA512

    6bff464d1992dedec869f4c08f7a08c2a12e10aee2df18dba7a2aad631c9112a2bb9d3d32381c9e8e2821ca60e2486fde87f2a4d30f4a07c33438d342722142b

  • SSDEEP

    3072:SMUY4YtYZ0G28mitfghT4W+ltOrWKDBr+yJb:fNRyeGBmitfghT2LOf

Malware Config

Extracted

Family

gozi

Targets

    • Target

      f900059b568c573369251b4396dbd6779c0eafb5f7eed91848a1281751135d78

    • Size

      163KB

    • MD5

      eacbb8fbbde17e2f7c3f503b04ac1bcf

    • SHA1

      cb32f4c7d0a318d8779b84f402f6824707822fb3

    • SHA256

      f900059b568c573369251b4396dbd6779c0eafb5f7eed91848a1281751135d78

    • SHA512

      6bff464d1992dedec869f4c08f7a08c2a12e10aee2df18dba7a2aad631c9112a2bb9d3d32381c9e8e2821ca60e2486fde87f2a4d30f4a07c33438d342722142b

    • SSDEEP

      3072:SMUY4YtYZ0G28mitfghT4W+ltOrWKDBr+yJb:fNRyeGBmitfghT2LOf

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

    • Detects executables built or packed with MPress PE compressor

    • UPX dump on OEP (original entry point)

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks