Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2fd0dd3f73a17a904e5445a92d164e939a56f3c4fe714818199e9a1fab23ec1a.exe

  • Size

    1.8MB

  • Sample

    240703-c95lksxgqr

  • MD5

    41781c0a35a8caafe31982e937e1dae0

  • SHA1

    9c65cfeb94c39819e043a3ce393c4a7bb8e2e91c

  • SHA256

    2fd0dd3f73a17a904e5445a92d164e939a56f3c4fe714818199e9a1fab23ec1a

  • SHA512

    80c707f5d9dfe1b04d8cd8285d39b129f9b5893be8d16bc14d2b226a040e513c865f7893514ce36a002e4ec42d040476bd30f5c7c73e3150be0d90a21ce93bc5

  • SSDEEP

    24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTd7QdZnbRh7t:Lz071uv4BPMkFfdk2auTxcPt

Malware Config

Targets

    • Target

      2fd0dd3f73a17a904e5445a92d164e939a56f3c4fe714818199e9a1fab23ec1a.exe

    • Size

      1.8MB

    • MD5

      41781c0a35a8caafe31982e937e1dae0

    • SHA1

      9c65cfeb94c39819e043a3ce393c4a7bb8e2e91c

    • SHA256

      2fd0dd3f73a17a904e5445a92d164e939a56f3c4fe714818199e9a1fab23ec1a

    • SHA512

      80c707f5d9dfe1b04d8cd8285d39b129f9b5893be8d16bc14d2b226a040e513c865f7893514ce36a002e4ec42d040476bd30f5c7c73e3150be0d90a21ce93bc5

    • SSDEEP

      24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t4oAirbNIjTd7QdZnbRh7t:Lz071uv4BPMkFfdk2auTxcPt

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.