Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

6c5db6dce1...3e.exe

windows7-x64

10

6c5db6dce1...3e.exe

windows10-2004-x64

10

DusBrowserInst.exe

windows7-x64

6

DusBrowserInst.exe

windows10-2004-x64

6

IDWCH2.exe

windows7-x64

7

IDWCH2.exe

windows10-2004-x64

7

Litever01.exe

windows7-x64

10

Litever01.exe

windows10-2004-x64

10

NAN.exe

windows7-x64

10

NAN.exe

windows10-2004-x64

10

anyname.exe

windows7-x64

3

anyname.exe

windows10-2004-x64

3

app.exe

windows7-x64

10

app.exe

windows10-2004-x64

10

askinstall50.exe

windows7-x64

10

askinstall50.exe

windows10-2004-x64

10

farlab_setup.exe

windows7-x64

7

farlab_setup.exe

windows10-2004-x64

7

inst002.exe

windows7-x64

10

inst002.exe

windows10-2004-x64

10

jamesnew.exe

windows7-x64

3

jamesnew.exe

windows10-2004-x64

3

justdezine.exe

windows7-x64

10

justdezine.exe

windows10-2004-x64

10

md3_3kvm.exe

windows7-x64

10

md3_3kvm.exe

windows10-2004-x64

10

mixseven.exe

windows7-x64

10

mixseven.exe

windows10-2004-x64

10

redcloud.exe

windows7-x64

10

redcloud.exe

windows10-2004-x64

10

udptest.exe

windows7-x64

10

udptest.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f75d6ee676e63208489f05cd8c82d44fdda74b5752963e3967071f2d2d080113

  • Size

    14.7MB

  • MD5

    36e895cac68782276f49144d8904f79e

  • SHA1

    411476265cdb80d2119ae49c34c6700a36577657

  • SHA256

    f75d6ee676e63208489f05cd8c82d44fdda74b5752963e3967071f2d2d080113

  • SHA512

    db7e7997e7017fc083b067aa9a610be84e425a5a562829a02dd3650b0dcf42a4ced706a69d27b7e86ce503558b13f9791b107f4281b0f4845e1d83a874e24550

  • SSDEEP

    393216:/OFW3CWhhMLh2BJcqpGZLvH023cP1vlhaR/nW67:/OFW3CWIIchL+2Rvf

Score
10/10
1.22socelarsredlinesectopratfabookie

Malware Config

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.xxhufdc.top/

http://www.uefhkice.xyz/

http://www.fcektsy.top/

Extracted

Family

redline

Botnet

1.22

C2

95.211.185.27:42097

Signatures

  • Detect Fabookie payload 1 IoCs
  • Fabookie family
    fabookie
  • RedLine payload 1 IoCs
  • Redline family
    redline
  • SectopRAT payload 1 IoCs
  • Sectoprat family
    sectoprat
  • Socelars family
    socelars
  • Socelars payload 1 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Unsigned PE 16 IoCs

    Checks for missing Authenticode signature.

Files

  • f75d6ee676e63208489f05cd8c82d44fdda74b5752963e3967071f2d2d080113
    .zip

    Password: infected

  • 1038157f6d8e0bc282524fefbc0825825ea32d47b23072bae22534c6c9803e3d
    .zip
  • 6c5db6dce13ded4e0e6c7e9a526b063e.exe
    .exe windows:5 windows x86 arch:x86

    aa21a6d00a5d2896042e00aa2e960393


    Code Sign

    Headers

    Imports

    Sections

  • DusBrowserInst.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • IDWCH2.exe
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • Litever01.exe
    .exe windows:5 windows x86 arch:x86

    aa21a6d00a5d2896042e00aa2e960393


    Headers

    Imports

    Sections

  • NAN.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • anyname.exe
    .exe windows:5 windows x86 arch:x86

    c6135ffdfa8b888ab780237cbe8d7634


    Headers

    Imports

    Sections

  • app.exe
    .exe windows:5 windows x86 arch:x86

    aa21a6d00a5d2896042e00aa2e960393


    Headers

    Imports

    Sections

  • askinstall50.exe
    .exe windows:6 windows x86 arch:x86

    4f0608b5638c60342069764638589dcf


    Headers

    Imports

    Sections

  • farlab_setup.exe
    .exe windows:1 windows x86 arch:x86


    Headers

    Sections

  • inst002.exe
    .exe windows:5 windows x86 arch:x86

    b900dc5ab09e702140c5c289f35fb91f


    Headers

    Imports

    Sections

  • jamesnew.exe
    .exe windows:5 windows x86 arch:x86

    eb97e4fc5518ac300a92a11673825e0b


    Headers

    Imports

    Sections

  • justdezine.exe
    .exe windows:5 windows x86 arch:x86

    aa21a6d00a5d2896042e00aa2e960393


    Headers

    Imports

    Sections

  • md3_3kvm.exe
    .exe windows:5 windows x86 arch:x86

    09d0478591d4f788cb3e5ea416c25237


    Headers

    Imports

    Sections

  • mixseven.exe
    .exe windows:5 windows x86 arch:x86

    aa21a6d00a5d2896042e00aa2e960393


    Headers

    Imports

    Sections

  • redcloud.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • udptest.exe
    .exe windows:5 windows x86 arch:x86

    aa21a6d00a5d2896042e00aa2e960393


    Headers

    Imports

    Sections

  • vguuu.exe
    .exe windows:6 windows x64 arch:x64

    0e0b1327b851d652046461e0a8be7593


    Headers

    Imports

    Sections