Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    R3lease-x64-[ver.fSgUXucwQOqR].zip

  • Size

    12.0MB

  • MD5

    d6e242dafc2eef6ac950b7b52533b301

  • SHA1

    b1856a2d2c2a28728998dc489902cafda480dcde

  • SHA256

    46e120ff62a89882952fc67111952edb6093f51f39dc7d0fd6c533557be6f458

  • SHA512

    9a558c450548f387c77177ec7a4f69d7ac2d22dd6913b7d4b2ad89f117557640391a6b17dde37c4b78875737ab6efd3a50ee33fa425be7ba99bf2d62b584064e

  • SSDEEP

    196608:gJvrPbs6ppV1zR7PVAuIU1fe+i6YmMNbZl/eTtcuU6UFmD4hZ79PZ1qyY2Hskn/S:6bZ/FPKsfp7EbZl/eTWuHUFPhvPZ1qCS

Score
9/10

Malware Config

Signatures

  • CryptOne packer 1 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • R3lease-x64-[ver.fSgUXucwQOqR].zip
    .zip

    Password: ryos

  • Bootstrapper.exe
    .exe windows:5 windows x86 arch:x86

    Password: ryos

    be41bf7b8cc010b614bd36bbca606973


    Code Sign

    Headers

    Imports

    Sections

  • $TEMP/Factors
  • $TEMP/Kijiji
  • $TEMP/Paradise
  • $TEMP/Talent
  • GraceDedicated/Attempt
  • GraceDedicated/Injuries
    .cab

    Password: ryos

  • Alan
  • Cio
  • Client
  • Contribute
  • Dept
  • Dialog
  • Eagle
  • Lotus
  • Relying
  • Resolved
  • Ta
  • GraceDedicated/Metres
  • GraceDedicated/Nice
  • GraceDedicated/Outlet
  • GraceDedicated/Row
  • README.txt
  • scripts/config.txt
    .js
  • scripts/local
    .dll regsvr32 windows:5 windows x86 arch:x86

    Password: ryos

    a9fd3e7f71a802c8eee0a502f46de991


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • scripts/uwp
    .dll windows:6 windows x86 arch:x86

    Password: ryos

    1c23c1ea89b7252f3716da06ebe3581f


    Headers

    Imports

    Exports

    Sections