Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    03b400868ee60c262ed4adcde7a4a1e0N

  • Size

    163KB

  • Sample

    240910-kaawxstgrk

  • MD5

    03b400868ee60c262ed4adcde7a4a1e0

  • SHA1

    9b450a9c0f4ed278459aabbce64d594b47ac6ff6

  • SHA256

    a333baa286527711332a5e8120973e60de88df6478fab8aa752bdb38913aa671

  • SHA512

    a077f0a2d925401982e803d64d6db4b3dc40a959e5d14fef5206fc13f376d23ff0399e3b345cd0f1fb4475124b5dc83ebe2e9ac5ce0622ae801ccfe9cc992dbc

  • SSDEEP

    1536:PHVXbsrz6qExxzXSlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:SmxxLSltOrWKDBr+yJb

Malware Config

Extracted

Family

gozi

Targets

    • Target

      03b400868ee60c262ed4adcde7a4a1e0N

    • Size

      163KB

    • MD5

      03b400868ee60c262ed4adcde7a4a1e0

    • SHA1

      9b450a9c0f4ed278459aabbce64d594b47ac6ff6

    • SHA256

      a333baa286527711332a5e8120973e60de88df6478fab8aa752bdb38913aa671

    • SHA512

      a077f0a2d925401982e803d64d6db4b3dc40a959e5d14fef5206fc13f376d23ff0399e3b345cd0f1fb4475124b5dc83ebe2e9ac5ce0622ae801ccfe9cc992dbc

    • SSDEEP

      1536:PHVXbsrz6qExxzXSlProNVU4qNVUrk/9QbfBr+7GwKrPAsqNVU:SmxxLSltOrWKDBr+yJb

    • Adds autorun key to be loaded by Explorer.exe on startup

    • Gozi

      Gozi is a well-known and widely distributed banking trojan.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks