Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
CZPgtmlLgThm.dll
-
Size
3.2MB
-
Sample
250210-rhs6sstncp
-
MD5
e102f51b67a248436f9729e410100a13
-
SHA1
d34e81135fd45258982d56ce66fcb0661daff9de
-
SHA256
b2bd3a7284b4dddb7412a5a929836200d9ec742af0d1af79de3ad164aceadf1a
-
SHA512
4ce752d04bbdca4b9f6af961ee473d37b84d9a845dd01afb959a6bd03842858939b0dbb55db859a500362d61a0ac177846911cbcf5de534fadbecedaabc5910a
-
SSDEEP
49152:6vMLhOv7qLYgOQkv2ldCcCgPqIo9xlf8ZirVq42tmAMK7+slR0+RNW8d:6v+0Yj/7VniJDfQiQVtD68tRNhd
Static task
static1
Behavioral task
behavioral1
Sample
CZPgtmlLgThm.dll
Resource
win7-20241010-en
Malware Config
Extracted
bumblebee
9090
-
dga
nvg55tpgvn.click
ulbun31qmv.click
7oc6be5fmy.click
bm76b9296k.click
h7xupkk0d3.click
fi7anseaj7.click
0u4bcayb8u.click
1cckgd13z5.click
562z75s3bp.click
1smmlbbiqr.click
cc5fi2q6ca.click
xisdha07tt.click
rvi6iv6l5v.click
kddpj0gryr.click
jmpxjjqhe8.click
ui1b0rvu0k.click
kqiqovthoj.click
zbldvupsdc.click
qdhqoj9s20.click
g841i9ksgn.click
uu4cx79e90.click
m9a2qfmqay.click
kc8svtokry.click
st9rdv9xai.click
i4965hr9jc.click
wkxfgjwonu.click
53y5nwsc6j.click
7ou7og586r.click
r5wrzrk1bi.click
am7gd0loc1.click
a2cey1j0xl.click
il1nlb7tn0.click
d7x2whgood.click
b5sqn635n9.click
nox7lvewcl.click
5buum8t9vl.click
fb25x2ju7i.click
ral9rhuaxy.click
mt9ycu98jr.click
8vndou1xlz.click
ul6105p00e.click
9hqid2tzng.click
lxw6duivu7.click
0dhalnnwr5.click
p6xuzncl71.click
lwpk3miw9n.click
t792ufhvll.click
o0fivl26q7.click
hmh20ykvlf.click
ixu6xial6v.click
dv14q2l82c.click
wz4pnl68jg.click
6709v1hcy1.click
x0822sepnx.click
ft8qxfxurc.click
64ud5xnryz.click
gflgt8sbzn.click
27c28lnp3v.click
g2to6sz5pi.click
i76uhrb930.click
h3p2sxyyk8.click
g90uubdr4p.click
nmgyqyrb8b.click
a53faphpe4.click
2wqfxxycnk.click
xa7wlz3r5y.click
27v2bofhl4.click
uc38lfln1t.click
akk5t6frjq.click
kiuxl1yijx.click
689c3d8ylq.click
3j6smer0tm.click
b8w2qcig4n.click
85ciukct31.click
b4j8gnyy3a.click
roc72ievev.click
3sehf3t4x5.click
hztr0qlwke.click
vig3u2t4fm.click
ehca1iots2.click
b4c6xa0j4f.click
y65z9jsgrh.click
a9ph8qf8d6.click
lp09sfynbd.click
62dp72sdft.click
7y2yvpkuff.click
y3hhmeydtr.click
kh2e843low.click
bao2cdlwd0.click
ufbt7kts4x.click
dls5ae3bfp.click
cbwsfxcdei.click
56azbsx5nm.click
rjafv9rkqq.click
cjbdm0nhub.click
xt58p1nya3.click
6y3igtg9t6.click
4q3m78acq6.click
rjj19c1jpn.click
nepygxz419.click
-
dga_seed
-5372979216912523469
-
domain_length
10
-
num_dga_domains
300
-
port
443
-
tld
.click
Targets
-
-
Target
CZPgtmlLgThm.dll
-
Size
3.2MB
-
MD5
e102f51b67a248436f9729e410100a13
-
SHA1
d34e81135fd45258982d56ce66fcb0661daff9de
-
SHA256
b2bd3a7284b4dddb7412a5a929836200d9ec742af0d1af79de3ad164aceadf1a
-
SHA512
4ce752d04bbdca4b9f6af961ee473d37b84d9a845dd01afb959a6bd03842858939b0dbb55db859a500362d61a0ac177846911cbcf5de534fadbecedaabc5910a
-
SSDEEP
49152:6vMLhOv7qLYgOQkv2ldCcCgPqIo9xlf8ZirVq42tmAMK7+slR0+RNW8d:6v+0Yj/7VniJDfQiQVtD68tRNhd
-
Bumblebee family
-
Downloads MZ/PE file
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-