Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    a424c8c4cc8ad901fdb368cf3e8d2f5c5174b42a3fff147d09b1072cc6a75e94N

  • Size

    244KB

  • Sample

    241005-ebyrgsxhjd

  • MD5

    fac83a63f0530074bbab15b03e8717b0

  • SHA1

    24c55c796064b5fb9afa3b22db5678acc3202695

  • SHA256

    a424c8c4cc8ad901fdb368cf3e8d2f5c5174b42a3fff147d09b1072cc6a75e94

  • SHA512

    5cdbbd3e40cbce73e06481cfdd0cc470bf5f4fa2031e81b442a7878c529cd15b2b0557bafbdc3cae9ed19720971f3afa73b26706012007342afd983cd17e3eb8

  • SSDEEP

    3072:hePgCctxGv4QcU9KQ2BBA2waPxhtmollrAN/kcMKF:dCctxGsWKQ2Bx5xvhcNOKF

Score
10/10

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.tripod.com
  • Port:
    21
  • Username:
    onthelinux
  • Password:
    741852abc

Targets

    • Target

      a424c8c4cc8ad901fdb368cf3e8d2f5c5174b42a3fff147d09b1072cc6a75e94N

    • Size

      244KB

    • MD5

      fac83a63f0530074bbab15b03e8717b0

    • SHA1

      24c55c796064b5fb9afa3b22db5678acc3202695

    • SHA256

      a424c8c4cc8ad901fdb368cf3e8d2f5c5174b42a3fff147d09b1072cc6a75e94

    • SHA512

      5cdbbd3e40cbce73e06481cfdd0cc470bf5f4fa2031e81b442a7878c529cd15b2b0557bafbdc3cae9ed19720971f3afa73b26706012007342afd983cd17e3eb8

    • SSDEEP

      3072:hePgCctxGv4QcU9KQ2BBA2waPxhtmollrAN/kcMKF:dCctxGsWKQ2Bx5xvhcNOKF

    Score
    10/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks