Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

ab9a25afd7...18.exe

windows7-x64

ab9a25afd7...18.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ab9a25afd7b77e29f59da960a716dd98_JaffaCakes118

  • Size

    148KB

  • Sample

    240614-1ln6paxbqh

  • MD5

    ab9a25afd7b77e29f59da960a716dd98

  • SHA1

    5a29e9fd7212a8b5537ae9e0daa19b51acca172a

  • SHA256

    4804ca167a5405cd9cd5539c7e670db54677e2a82081b665cc8b22a426b91b64

  • SHA512

    7ea69840e4f0e3d46b3098400169d17ee735f5a46b2d4bd7af25e158bef2cf18829fb51f7f7b6dc2262c51e41e67f597b8ced62a7788f009438213a36321c511

  • SSDEEP

    3072:4OzIy5XGViztldWl88Yed2DQuIAQvQ+d0aYk/05bgJf:4o2ViztvWlvd2UuIAQvQ+yFO0xgh

Score
10/10
netwirerat

Malware Config

Extracted

Family

netwire

C2

fucktoto.duckdns.org:3369

Attributes
  • activex_autorun

    true

  • activex_key

    {4KUJJ476-38ES-RCMH-QGW0-22030L368G76}

  • copy_executable

    true

  • delete_original

    false

  • host_id

    blower

  • install_path

    %AppData%\Install\Host.exe

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    gbam1234

  • registry_autorun

    true

  • startup_name

    NetWire

  • use_mutex

    false

Targets

    • Target

      ab9a25afd7b77e29f59da960a716dd98_JaffaCakes118

    • Size

      148KB

    • MD5

      ab9a25afd7b77e29f59da960a716dd98

    • SHA1

      5a29e9fd7212a8b5537ae9e0daa19b51acca172a

    • SHA256

      4804ca167a5405cd9cd5539c7e670db54677e2a82081b665cc8b22a426b91b64

    • SHA512

      7ea69840e4f0e3d46b3098400169d17ee735f5a46b2d4bd7af25e158bef2cf18829fb51f7f7b6dc2262c51e41e67f597b8ced62a7788f009438213a36321c511

    • SSDEEP

      3072:4OzIy5XGViztldWl88Yed2DQuIAQvQ+d0aYk/05bgJf:4o2ViztvWlvd2UuIAQvQ+yFO0xgh

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.