Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    945103d43a3b4db2fdded297ec9625e54f4d7f494aeb27280e133bac22389673

  • Size

    5.8MB

  • Sample

    240617-fshbhazdkp

  • MD5

    875191f204d65fba87578811a903b55c

  • SHA1

    f5f246da6aa53095f3fd1cc5b798af0f626464f6

  • SHA256

    945103d43a3b4db2fdded297ec9625e54f4d7f494aeb27280e133bac22389673

  • SHA512

    18319a7dac083bbacaff0d23e6d04c2f45d1af1655830e063102b70789c8ef065e824dfbc2d5073edb7884326faefdda813cb0bd7135e57722d9b383f65ef84b

  • SSDEEP

    98304:mat5MY7lL4fOoffsRGRS2PJrHKLQ/wAzRQwLn368K3BVKQI+fkrYtg91qSe/fC:n5MqBeO+SwJWAza1RVw+fGv1unC

Malware Config

Extracted

Family

socks5systemz

C2

bwjmqef.com

http://bwjmqef.com/search/?q=67e28dd8690cfb204406a51a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa49e8889b5e4fa9281ae978fe71ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6f88ff11c9eb9c

bxeungo.com

http://bxeungo.com/search/?q=67e28dd8685af379125bfd4e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa49e8889b5e4fa9281ae978f271ea771795af8e05c645db22f31dfe339426fa11a366c350adb719a9577e55b8603e983a608ff717c0ef9c9e3e

Targets

    • Target

      945103d43a3b4db2fdded297ec9625e54f4d7f494aeb27280e133bac22389673

    • Size

      5.8MB

    • MD5

      875191f204d65fba87578811a903b55c

    • SHA1

      f5f246da6aa53095f3fd1cc5b798af0f626464f6

    • SHA256

      945103d43a3b4db2fdded297ec9625e54f4d7f494aeb27280e133bac22389673

    • SHA512

      18319a7dac083bbacaff0d23e6d04c2f45d1af1655830e063102b70789c8ef065e824dfbc2d5073edb7884326faefdda813cb0bd7135e57722d9b383f65ef84b

    • SSDEEP

      98304:mat5MY7lL4fOoffsRGRS2PJrHKLQ/wAzRQwLn368K3BVKQI+fkrYtg91qSe/fC:n5MqBeO+SwJWAza1RVw+fGv1unC

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks