Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

ca97bd5dbb...09.dll

windows7-x64

10

ca97bd5dbb...09.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ca97bd5dbbcb449c0b49f54d9dceff863678578e2fb9293baa10e5790693cf09

  • Size

    638KB

  • Sample

    250228-c5ppkaxyet

  • MD5

    51c8980f12f9f2c24350e5e06ffe8b2e

  • SHA1

    3aa5663d81eb8bae16e3217f206e38a3333e04c6

  • SHA256

    ca97bd5dbbcb449c0b49f54d9dceff863678578e2fb9293baa10e5790693cf09

  • SHA512

    e1638f95566c31c723cfc098690a2beff1eba0f292563ae082d603a5ce0d2b88ccec50abe17e4c42fa56677a588db19b5d9000843fd9a64851179bf29603f422

  • SSDEEP

    12288:TMFaRxiRVw4GEBkvkNbBUT29aCBYC8Hc/sdL9nHGqxHZC5gDG+pG/Y6:TMkxh49kvkNbHCW0d5HG0CeJgY6

Score
10/10
ramnitzloaderplspamplspambankerbotnetdiscoverypersistencespywarestealertrojanupxworm

Malware Config

Extracted

Family

zloader

Botnet

PLSPAM

Campaign

PLSPAM

C2

http://marchadvertisingnetwork4.com/post.php

http://marchadvertisingnetwork5.com/post.php

http://marchadvertisingnetwork6.com/post.php

http://marchadvertisingnetwork7.com/post.php

http://marchadvertisingnetwork8.com/post.php

http://marchadvertisingnetwork9.com/post.php

http://marchadvertisingnetwork10.com/post.php
Attributes
  • build_id

    27

rc4.plain

Targets

    • Target

      ca97bd5dbbcb449c0b49f54d9dceff863678578e2fb9293baa10e5790693cf09

    • Size

      638KB

    • MD5

      51c8980f12f9f2c24350e5e06ffe8b2e

    • SHA1

      3aa5663d81eb8bae16e3217f206e38a3333e04c6

    • SHA256

      ca97bd5dbbcb449c0b49f54d9dceff863678578e2fb9293baa10e5790693cf09

    • SHA512

      e1638f95566c31c723cfc098690a2beff1eba0f292563ae082d603a5ce0d2b88ccec50abe17e4c42fa56677a588db19b5d9000843fd9a64851179bf29603f422

    • SSDEEP

      12288:TMFaRxiRVw4GEBkvkNbBUT29aCBYC8Hc/sdL9nHGqxHZC5gDG+pG/Y6:TMkxh49kvkNbHCW0d5HG0CeJgY6

    Score
    10/10
    ramnitzloaderplspamplspambankerbotnetdiscoverypersistencespywarestealertrojanupxworm

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Ramnit family

      ramnit

    • Zloader family

      zloader

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks