Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    archive_46.zip

  • Size

    65.7MB

  • MD5

    03f590f0ac7b1e46a98213db8643e26e

  • SHA1

    faf6a6eaeed17a09a95017bc3e6720a5c3310ffd

  • SHA256

    a40626fbe1122175c403f8510e1f6ad41cee213a87ce8252305e32e5071a170a

  • SHA512

    4fbf6129695bf3ce905e620e21f597c650561e4a88715e441960d2956d014798577e1f92d8c0233ce4d78b3e05d72b7dd43464136f5a11986378758387038db5

  • SSDEEP

    1572864:6U00oDoL7wjQhtIsj1koTLwqd53qiN9q+I2wkyPUiTeQzn0:voD87wjQhtIsZvTLVd5jP5eaQzn0

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HACKED

C2

mrtorrent32.ddns.net:1177

Mutex

12ce4e06a81e8d54fd01d9b762f1b1bb

Attributes
  • reg_key

    12ce4e06a81e8d54fd01d9b762f1b1bb

  • splitter

    |'|'|

Extracted

Family

njrat

Version

Platinum

Botnet

HacKed

C2

127.0.0.1:6126

Mutex

Client.exe

Attributes
  • reg_key

    Client.exe

  • splitter

    |Ghost|

Extracted

Family

growtopia

C2

https://discordapp.com/api/webhooks/730377507630743563/CTrQfMGpsjTTGCS5L_vCDbiyLqcVjXDI2n7WnjcxEmhX5IuwdHJQwjkb9te1VA7QLViH

https://discordapp.com/api/webhooks/731971810739879986/OpZic7KuzzPIt0T_lIHObsqHtrAD0WY9AzKT1vHjAK_rPz_Tg7O0QUz_n2R-fFNBWIkM

Attributes
  • payload_url

    https://cdn.discordapp.com/attachments/715259687049756713/724200009171468368/decoder.exe

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Victim

C2

thursday-bytes.gl.at.ply.gg:55648

Mutex

caa5ab06fdce65c809c563c98d39620a

Attributes
  • reg_key

    caa5ab06fdce65c809c563c98d39620a

  • splitter

    Y262SUCZ4UJJ

Extracted

Family

xworm

C2

fact-standings.gl.at.ply.gg:5666

wrong-observations.gl.at.ply.gg:5996

Attributes
  • Install_directory

    %AppData%

  • install_file

    svhost.exe

Signatures

  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Dcrat family
  • Detect Xworm Payload 2 IoCs
  • Detects Rhadamanthys payload 1 IoCs
  • Growtopia family
  • Njrat family
  • Rhadamanthys family
  • Xworm family
  • Unsigned PE 27 IoCs

    Checks for missing Authenticode signature.

Files

  • archive_46.zip
    .zip
  • bca3772529d1a336233bb4e59a704d5217e6e1f7b80222d2d028bfc816cb5445.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • bccb34575fb2db34d4a29075cb2f9aa39904b7d5412695545f2240c00fbb0472.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • bcf1af9a5a93ae74ea1c79da9951c5be.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • bcf783e363557f5bdd4014c159ae2497.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • bd515574dc1cb379674710f110e907d8cd72a5e4c5eb90d464fbee847b71718c.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • bd68ca7605316450c87b9218d2dbe19d8c5694e07b93f320f3ca4a9ad902c139.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • bd707a0357b19ea6953d47900bb051e3.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • bd7edfedebe8a680d801ffd5b2415cd3877e95c78edb8cfc44eaae3e0e9a1e0b.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • bdad1ff46d46963cc687d5f6889c9ef2.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • bdae9ff15952ccdfec0be80562f1cbdf.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • be01d2552c64422f1b97721af2e07451309244c21e464bbe47b603043d95b21c.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • be077774c9e78bbe8c9388aa7d552de77e9ef40ec732ea193da049a0db2e5787.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • be0a8aeb7e1655bee6255bac9c2947ecef511b5f00e29933dfd9c7f39965bf56.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • be1643898cf51a24e38e4044d24ae1f5.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • be183db6d4b77c092496c69c3f389b94.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • be2375e810af4d76a0fc392d8acf2d1218cd2c21a6b8160be7f1f30ef7cf4694.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • be2dd1401101368df22a500f058f7b675c26d8f0950adf1afe94c4dfd7ada14b.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • be346116d6431e26497a581d86cb1c28.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • be48f3cc7b0a4469e8e1ab4e8ee15429f65d5eb7ec56fb19b5d3a45ad1c4976c.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • be4bf3ab7acd6e45a78cb15cae66c358.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • be869cf8a558b5126d6381e161bf693a947d206a7a5b8dcdec79658817daba5b.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • be8d993b659be9d4d3f24bb08654b3b0.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • bebba6b5b7159ac9c0fdc0e2b0548b8fe3416550a0797be374f6b17777cd9355.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • bed891787d21e55eb6ca71f8372b2783.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • beff81f6fcd7d16b9bfff76faee1118b.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • bf34125bb055fb600a3f4d71be2b65469e5276dfa0ced036de081e0dca5c4dae.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • bf3ea3cf938baaa4dc7716ee250db077.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • bf51083754ecf01b2f7e32b1d8e993d5.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • bfa11b45badf3afce8994ecd3e1e9cae.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • bfa4809d5cf3be23aba213497a006f20c7290b409591419759117f368c9478d6.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • bfb33129d91ff98553e6649d8dc3be8f2d0b57324fc9c3d9b9e64042b66d85ba.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • bfba84d9c13b673ec93bf909c2af4195.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections