Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
af33dfad37c0e54b3699fe6638cdcf37_JaffaCakes118
-
Size
366KB
-
Sample
240615-tdgy3swdrc
-
MD5
af33dfad37c0e54b3699fe6638cdcf37
-
SHA1
314746f4a936703583f537b606db8f691130875d
-
SHA256
d5ff35a0e6b9ca3e80e66ff47b5c6374a92f7aa363c35a4b08babf5155a1ecbd
-
SHA512
e9fc4efd90b7a1bd63a61b098e521d2dad9db8ca9f540477231f72493c02fec0b5190bab4e51593e7e29ab620900ac320b9083a44d430a4cf9947dd15b9c3f41
-
SSDEEP
6144:I8sjo/yfduhvw8OsdeOxUT0gFVSDvCz4d0YY5FMQkGcMY0yuYLRPmVI42idL:l/yEh8UUfyTb6kQkGc6yugR94fdL
Static task
static1
Behavioral task
behavioral1
Sample
أمر الشراء 90037-2020.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
أمر الشراء 90037-2020.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
netwire
43.226.229.43:2030
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
ALPHA
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password
-
registry_autorun
true
-
startup_name
NetWire
-
use_mutex
false
Targets
-
-
Target
أمر الشراء 90037-2020.exe
-
Size
762KB
-
MD5
598b0e23c0eb2baffc02fd05ce1b41e9
-
SHA1
4129fe98ba4e3580b3b05b61a06e301ae9c4b958
-
SHA256
a9a8374950d68997b782dca8ae2464aa81709c2f51bcc8fdb1abdcfb5b40c521
-
SHA512
e0b9a407e34ec24dbb76b84899f2d8665a87e02f1d278007357f1cb9680a712cd91d222e57340caed8337be1c7e66cf91d9586f7403ca31412920b1b8633c619
-
SSDEEP
12288:1CbpcLhilrm7G8oclWEAroCo3DQmTccdAAo3ZNytUAV:auLhi80Jro7JATZ0
Score10/10-
NetWire RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-