Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    TNoodle-WCA-1.2.2.jar

  • Size

    29.8MB

  • Sample

    240521-j4m8nseb32

  • MD5

    9f7103370956308807e2c6529f459133

  • SHA1

    e9c1227a7557ce7d62c59e4183f39b750ddf13e0

  • SHA256

    151fb27eae66cd0cd335f1717668d26e8530bb5d0266a0c5f871395dcd6237c1

  • SHA512

    30f44daca0b86f28a571db43e0958f465fe56c9a54b51c1487a927d8da2a356e613dea8f2f8a72142ca6e3babeaf257b1315edff14c8eb3d76755e5c66d5f2df

  • SSDEEP

    786432:/mznhtI2TkLLD44F4k/6Qe+jRBBJdCQgbg:+bOLo4F4Ke+lBBJgQg0

Malware Config

Targets

    • Target

      TNoodle-WCA-1.2.2.jar

    • Size

      29.8MB

    • MD5

      9f7103370956308807e2c6529f459133

    • SHA1

      e9c1227a7557ce7d62c59e4183f39b750ddf13e0

    • SHA256

      151fb27eae66cd0cd335f1717668d26e8530bb5d0266a0c5f871395dcd6237c1

    • SHA512

      30f44daca0b86f28a571db43e0958f465fe56c9a54b51c1487a927d8da2a356e613dea8f2f8a72142ca6e3babeaf257b1315edff14c8eb3d76755e5c66d5f2df

    • SSDEEP

      786432:/mznhtI2TkLLD44F4k/6Qe+jRBBJdCQgbg:+bOLo4F4Ke+lBBJgQg0

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks