Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

35bef39478...92.dll

windows7-x64

3

35bef39478...92.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_d3b47982dc74bc3984e515dcad6787014924f1e941b3ef71b7a83c39742a0979

  • Size

    38KB

  • MD5

    a7228c0eb847cd8f0cc03a75d20b3a03

  • SHA1

    1f1b1e0556f50c7241a3faeb1c2ca32cb4c9ec74

  • SHA256

    d3b47982dc74bc3984e515dcad6787014924f1e941b3ef71b7a83c39742a0979

  • SHA512

    6f82f50c60ea2916a9b4cb201ceb9029298f8e03ad3223ddd388c4697c9c2e0750d4ff4f91ebf8f9d98c71059c639a96f11677faffed19a052b793b220dd1d42

  • SSDEEP

    768:FrKB00gb5/EzMAogX6OP4jk5CzWh7g/zGOjUI1cLB7EGhy3tCgn5zUM:Vn0gb5/4MALrdQzQ7g/zBV1KqdtC25zL

Score
10/10
isfb4463gozi

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

4463

C2

1.microsoft.com

silugerude.xyz

vilugerude.xyz
Attributes
  • base_path

    /palok/

  • build

    250193

  • dga_base_url

    constitution.org/usdeclar.txt

  • dga_crc

    0x4eb7d2ca

  • dga_season

    10

  • dga_tlds

    com

    ru

    org

  • exe_type

    loader

  • extension

    .trb

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi family
    gozi
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_d3b47982dc74bc3984e515dcad6787014924f1e941b3ef71b7a83c39742a0979
    .zip

    Password: infected

  • 35bef39478577d735b1c8104f5800e95d73487284c89b281283e4c117688bd92.dll
    .dll regsvr32 windows:4 windows x86 arch:x86

    9b4bd5e9c744a772e2cae4b95c84d26f


    Headers

    Imports

    Exports

    Sections