Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    1282f6e8aff7636cb45be17b878101722385dad8a70ad41b004edf12bffedf8cN.exe

  • Size

    145KB

  • Sample

    250112-fagl9ayqaq

  • MD5

    8af9d631e3b95e75f06de656920fad10

  • SHA1

    22be884c219889aaa83c9e3782758133f77b42d5

  • SHA256

    1282f6e8aff7636cb45be17b878101722385dad8a70ad41b004edf12bffedf8c

  • SHA512

    29ab5304715512353a4f27f7d32a8e6bb7baee1b0c121783b388ccce15c6e5262abf94a08fff7081d6b6e7edbf409745bae667fd6cf8172f81c26dd90d24d903

  • SSDEEP

    3072:Y+EoUPRgWH18MmaqD1SdXL98N9r6UwUTUCt78HlR0s:EuYqMm716Blp

Malware Config

Targets

    • Target

      1282f6e8aff7636cb45be17b878101722385dad8a70ad41b004edf12bffedf8cN.exe

    • Size

      145KB

    • MD5

      8af9d631e3b95e75f06de656920fad10

    • SHA1

      22be884c219889aaa83c9e3782758133f77b42d5

    • SHA256

      1282f6e8aff7636cb45be17b878101722385dad8a70ad41b004edf12bffedf8c

    • SHA512

      29ab5304715512353a4f27f7d32a8e6bb7baee1b0c121783b388ccce15c6e5262abf94a08fff7081d6b6e7edbf409745bae667fd6cf8172f81c26dd90d24d903

    • SSDEEP

      3072:Y+EoUPRgWH18MmaqD1SdXL98N9r6UwUTUCt78HlR0s:EuYqMm716Blp

    • Andromeda family

    • Andromeda, Gamarue

      Andromeda, also known as Gamarue, is a modular botnet malware primarily used for distributing other types of malware and it's written in C++.

    • Detects Andromeda payload.

    • Adds policy Run key to start application

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks