Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

cdb1365059...fbc.gz

windows7-x64

1

cdb1365059...fbc.gz

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    infected.7z

  • Size

    80.4MB

  • Sample

    250312-rnzwjaszev

  • MD5

    cf25242af21ffb257ec3b670fe3bff9c

  • SHA1

    a96400547e93790a9b16450ae0fff715efd6fc21

  • SHA256

    d36e8aa297749e5909316230b55c07fa185761d2f58699e6caefdf3a8141168e

  • SHA512

    f2ed8221f1bb3140115d3c170495a24cc6adc28b3a87b51f2c0ae583c4b4710fba9217e66d0df859db5c250ea47ba07eae174e146b13bd791b9d65983e4c9567

  • SSDEEP

    1572864:9c2eO+OHpOV3D8iOjaVPBHd4uiehiH1W9e7uKweDrnI3ZW6yFwdAf67u2CZo9h:m2eO+OJE3IYd6VH1W9e7/prnI3ZWDWAk

Score
10/10
agentteslacobaltstrikedcratgafgytgh0stratmiraimrblacknanocoreneconydnjratponyredosdrusakulaurelasxorddos1359593325miraimybotaspackv2macromacro_on_actionratupx

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

C2

botnet.goelites.cc

Extracted

Family

gafgyt

C2

209.126.73.248:839

45.144.29.99:42516

104.206.252.100:42516

217.61.7.114:72

107.172.137.175:7777

85.204.116.33:717

192.223.29.160:42516

Extracted

Family

mirai

Botnet

MIRAI

C2

botnet.goelites.cc

Extracted

Family

mirai

Botnet

MIRAI

Extracted

Family

xorddos

C2

http://aa.hostasa.org/game.rar

ns3.hostasa.org:3306

ns4.hostasa.org:3306

ns1.hostasa.org:3306

ns2.hostasa.org:3306

ns3.hostasa.org:3310

ns4.hostasa.org:3310

ns1.hostasa.org:3310

ns2.hostasa.org:3310

http://info1.3000uc.com/b/u.php

gh.dsaj2a1.org:2822

www.wangzongfacai.com:2822

174.139.217.145:2822

ns3.hostasa.org:3308

ns4.hostasa.org:3308

ns1.hostasa.org:3308

ns2.hostasa.org:3308

ns3.hostasa.org:3307

ns4.hostasa.org:3307

ns1.hostasa.org:3307
Attributes
  • crc_polynomial

    EDB88320

xor.plain

Extracted

Family

redosdru

C2

http://42.51.154.54:88/NetSyst81.dll

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    webmail.ombakparadise.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    ce$%^mirah

Extracted

Family

nanocore

Version

1.2.2.0

C2

192.168.1.1:54984

127.0.0.1:54984
Mutex

4e3184db-fd2f-47b2-8daf-030abc4baf4c

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    127.0.0.1

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2021-09-12T00:43:48.877032236Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    54984

  • default_group

    HelloWorld

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    4e3184db-fd2f-47b2-8daf-030abc4baf4c

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    192.168.1.1

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Extracted

Family

neconyd

C2

http://ow5dirasuek.com/

http://mkkuei4kdsz.com/

http://lousta.net/

Extracted

Family

pony

C2

http://don.service-master.eu/gate.php

Attributes
  • payload_url

    http://don.service-master.eu/shit.exe

Extracted

Family

mirai

Botnet

MIRAI

Extracted

Family

njrat

Version

0.7d

Botnet

MyBot

C2

8.tcp.ngrok.io:13962

Mutex

aaffeb7a5f54025070b8e182b1fa7d98

Attributes
  • reg_key

    aaffeb7a5f54025070b8e182b1fa7d98

  • splitter

    Y262SUCZ4UJJ

Extracted

Family

cobaltstrike

Botnet

1359593325

C2

http://173.234.155.223:80/boxes.css

Attributes
  • access_type

    512

  • host

    173.234.155.223,/boxes.css

  • http_header1

    AAAAEAAAABtIb3N0OiBzeW1hbnRlY3NlY3VyaXR5dC5jb20AAAAKAAAAEUNvbm5lY3Rpb246IGNsb3NlAAAACgAAABJBY2NlcHQ6IGltYWdlL2pwZWcAAAAHAAAAAAAAAAsAAAADAAAAAgAAADV3b3JkcHJlc3NfbG9nZ2VkX2luXzE4NzBhODI5ZDliYzY5YWJmNTAwZWNhNmYwMDI0MWZlPQAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAAEAAAABtIb3N0OiBzeW1hbnRlY3NlY3VyaXR5dC5jb20AAAAKAAAAEUNvbm5lY3Rpb246IGNsb3NlAAAACgAAABVBY2NlcHQtRW5jb2Rpbmc6IGd6aXAAAAAKAAAAL0NvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkAAAABwAAAAEAAAAPAAAAAwAAAAIAAAAHYnJva2VuPQAAAAQAAAAHAAAAAAAAAAMAAAACAAAADl9fc2Vzc2lvbl9faWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • jitter

    11008

  • polling_time

    61757

  • port_number

    80

  • sc_process32

    %windir%\syswow64\WUAUCLT.exe

  • sc_process64

    %windir%\sysnative\WUAUCLT.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJvC2CQYaIouT41kXKVNrM5lLvclGJRE+i3ves+vC0AADUWTPs64Dn/B4eKlQKPpbC/8IgJjadD/B9pZiY8XUlk4dvaagLdjBCq7uSxS+KhVVsX46LBSBgIxaE4AeoZvwBD2n0wdeeI2sbkMvDhhv5s6Nmz12sAtOVGdr8cX3s5QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    2.708806656e+09

  • unknown2

    AAAABAAAAAIAAAPVAAAAAwAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /ce

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246

  • watermark

    1359593325

Targets

    • Target

      cdb1365059c0e4973843dc0d0955bfbc.vir

    • Size

      3.0MB

    • MD5

      cdb1365059c0e4973843dc0d0955bfbc

    • SHA1

      eaa991e3a9c57302f31ac5faba09d7f00f65c8b6

    • SHA256

      1a880b81f53f4c162e7c90d098c185da9cc936988f0ea4fdb278c661d68f9996

    • SHA512

      17d136b87efde90b50daccb84bd85dd09706af14ee5a2a963655ec2df06aa3173915ccb479010098061dbf079c716197d6a311eff3b0c722daf46c00295af4eb

    • SSDEEP

      49152:hOZEQTQW+E7Lj+TTbUn/7oxHQKpyGQJ3EGbKpIbamHwTCjFhtbyh3lMk+rhiCpD6:hcEQSE6TTQ7o9QhGmEMKaWmwCjdWh3+K

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks