Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
System.exe
-
Size
67KB
-
Sample
240904-cez3lsvane
-
MD5
5ee1967cc9cde8045b3c8f3a37f685f6
-
SHA1
62429cb9fbbe082a579c6a908ec4e317cf6a3291
-
SHA256
ddef68a4504b078ddd6f8c5f665898546eb019e2f134551f5b24909f51d668ec
-
SHA512
386862a68a3c32d00f2b6fcc8361ad7379dada70b4f28d4ff8077d569b078574a1bc23b33755f9fc1960e69e6efb2182663f8120075e97a0012e1eacb186d014
-
SSDEEP
1536:tRIUpAK1jniTJUnvPksl9jhK+bH51lT3RmAOvwX8RT:thpAK1jnzv/BK+bH5bT31OvwMt
Behavioral task
behavioral1
Sample
System.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
System.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
xworm
newstartagain.servequake.com:7001
newstartagain50.duckdns.org:7001
-
Install_directory
%AppData%
-
install_file
USB.exe
-
telegram
https://api.telegram.org/bot7114416350:AAF9PJoo6_MYxNu2qBazQWSWsWE1Jb_-yh8/sendMessage?chat_id=6653386349
Targets
-
-
Target
System.exe
-
Size
67KB
-
MD5
5ee1967cc9cde8045b3c8f3a37f685f6
-
SHA1
62429cb9fbbe082a579c6a908ec4e317cf6a3291
-
SHA256
ddef68a4504b078ddd6f8c5f665898546eb019e2f134551f5b24909f51d668ec
-
SHA512
386862a68a3c32d00f2b6fcc8361ad7379dada70b4f28d4ff8077d569b078574a1bc23b33755f9fc1960e69e6efb2182663f8120075e97a0012e1eacb186d014
-
SSDEEP
1536:tRIUpAK1jniTJUnvPksl9jhK+bH51lT3RmAOvwX8RT:thpAK1jnzv/BK+bH5bT31OvwMt
Score10/10-
Detect Xworm Payload
-
Adds Run key to start application
-