Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae

  • Size

    93KB

  • Sample

    240720-xvc81awbrc

  • MD5

    cda76c5daf293a188eb6d41fb9d989ca

  • SHA1

    d84c12c503c5075d6b132036753294dda0e1c400

  • SHA256

    dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae

  • SHA512

    902caf0767009dfa3f2fd24941aa19cf905eb5f7a418e431060494e49b561c4f88da315bb97bcfd3aa1d50145f38a5f63eeae444b078eb690c545eb216e11f08

  • SSDEEP

    768:9Y3Q5yD9O/pBcxYsbae6GIXb9pDX2t98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3+sGS:P5IOx6baIa9RZj00ljEwzGi1dDaDcgS

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

127.0.0.1:37615

Mutex

34d9934b339c8c0450a472268227412e

Attributes
  • reg_key

    34d9934b339c8c0450a472268227412e

  • splitter

    |'|'|

Targets

    • Target

      dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae

    • Size

      93KB

    • MD5

      cda76c5daf293a188eb6d41fb9d989ca

    • SHA1

      d84c12c503c5075d6b132036753294dda0e1c400

    • SHA256

      dfc31dbf4e5c1233029d8e9a9bdfc15d4fa5b08dbac745d9b73d49d5eaf8f1ae

    • SHA512

      902caf0767009dfa3f2fd24941aa19cf905eb5f7a418e431060494e49b561c4f88da315bb97bcfd3aa1d50145f38a5f63eeae444b078eb690c545eb216e11f08

    • SSDEEP

      768:9Y3Q5yD9O/pBcxYsbae6GIXb9pDX2t98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3+sGS:P5IOx6baIa9RZj00ljEwzGi1dDaDcgS

    • Modifies Windows Firewall

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks