Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
RedTigerSetup.exe
-
Size
308KB
-
Sample
240825-2rf8ps1erj
-
MD5
08bd9d8eadefed4a4b7323d0027de5b6
-
SHA1
e165b2a08c8fe165ab8623ad2f1897d67f426ce2
-
SHA256
0e7104024d8eda4017d891550c1bcc2f5dd9ed80e9ac996898e5cf82a8919a12
-
SHA512
108797ae485ef95640496fbca226af9185811c9e6d35d46925e66b7bab9ba1ec9c81142ac24d5a561bd603c2cb5f12c49e5a1510d33ffd5474085fda23e6c9cc
-
SSDEEP
3072:tMPMabg5GKQfjkHVOBpaIEzgmn8d0oX3XEH9eRrPEX+FzwEenQ1/8rEXKuFA9:tMlbIofIH37Z80qXEHwRzkEzfmoy
Behavioral task
behavioral1
Sample
RedTigerSetup.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
RedTigerSetup.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
xworm
agency-lottery.gl.at.ply.gg:21526
-
Install_directory
%AppData%
-
install_file
startup.exe
-
telegram
https://api.telegram.org/bot7319597697:AAHEbms2pAMZzB0yEpJIAUJdEfo9KHqsC4g/sendMessage?chat_id=7534517325
Targets
-
-
Target
RedTigerSetup.exe
-
Size
308KB
-
MD5
08bd9d8eadefed4a4b7323d0027de5b6
-
SHA1
e165b2a08c8fe165ab8623ad2f1897d67f426ce2
-
SHA256
0e7104024d8eda4017d891550c1bcc2f5dd9ed80e9ac996898e5cf82a8919a12
-
SHA512
108797ae485ef95640496fbca226af9185811c9e6d35d46925e66b7bab9ba1ec9c81142ac24d5a561bd603c2cb5f12c49e5a1510d33ffd5474085fda23e6c9cc
-
SSDEEP
3072:tMPMabg5GKQfjkHVOBpaIEzgmn8d0oX3XEH9eRrPEX+FzwEenQ1/8rEXKuFA9:tMlbIofIH37Z80qXEHwRzkEzfmoy
Score10/10-
Detect Xworm Payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1