Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    RedTigerSetup.exe

  • Size

    308KB

  • Sample

    240825-2rf8ps1erj

  • MD5

    08bd9d8eadefed4a4b7323d0027de5b6

  • SHA1

    e165b2a08c8fe165ab8623ad2f1897d67f426ce2

  • SHA256

    0e7104024d8eda4017d891550c1bcc2f5dd9ed80e9ac996898e5cf82a8919a12

  • SHA512

    108797ae485ef95640496fbca226af9185811c9e6d35d46925e66b7bab9ba1ec9c81142ac24d5a561bd603c2cb5f12c49e5a1510d33ffd5474085fda23e6c9cc

  • SSDEEP

    3072:tMPMabg5GKQfjkHVOBpaIEzgmn8d0oX3XEH9eRrPEX+FzwEenQ1/8rEXKuFA9:tMlbIofIH37Z80qXEHwRzkEzfmoy

Malware Config

Extracted

Family

xworm

C2

agency-lottery.gl.at.ply.gg:21526

Attributes
  • Install_directory

    %AppData%

  • install_file

    startup.exe

  • telegram

    https://api.telegram.org/bot7319597697:AAHEbms2pAMZzB0yEpJIAUJdEfo9KHqsC4g/sendMessage?chat_id=7534517325

Targets

    • Target

      RedTigerSetup.exe

    • Size

      308KB

    • MD5

      08bd9d8eadefed4a4b7323d0027de5b6

    • SHA1

      e165b2a08c8fe165ab8623ad2f1897d67f426ce2

    • SHA256

      0e7104024d8eda4017d891550c1bcc2f5dd9ed80e9ac996898e5cf82a8919a12

    • SHA512

      108797ae485ef95640496fbca226af9185811c9e6d35d46925e66b7bab9ba1ec9c81142ac24d5a561bd603c2cb5f12c49e5a1510d33ffd5474085fda23e6c9cc

    • SSDEEP

      3072:tMPMabg5GKQfjkHVOBpaIEzgmn8d0oX3XEH9eRrPEX+FzwEenQ1/8rEXKuFA9:tMlbIofIH37Z80qXEHwRzkEzfmoy

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks