Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    archive_15.zip

  • Size

    34.6MB

  • MD5

    7f3944a349f295202d784cd388eef05a

  • SHA1

    427e7d29593be751c6c10f81f3e58b816fe79677

  • SHA256

    7e71c79883eb025596762b4e0bf86b447039079dfe510ccf13a383b612575fa6

  • SHA512

    d80befe7df86a473a098b9b00ef3d26b6a7d7407c194cf9d471a8da1e7a20ecbb86b759266e17f6c1a8f353f9b2d652f5e6032ef5ee5c9d9289f0c0ee1cbd599

  • SSDEEP

    786432:2Paqcyrhk54qpiDw6up//yxNeiHZUKLZ9FlRVsE:24cEwE9aFHZUKxlLsE

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

score-fears.gl.at.ply.gg:6905

Mutex

47ed2009f1c922f581a240792169875b

Attributes
  • reg_key

    47ed2009f1c922f581a240792169875b

  • splitter

    |'|'|

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

if-contest.gl.at.ply.gg:5461

Mutex

Windows Update

Attributes
  • reg_key

    Windows Update

  • splitter

    |Hassan|

Extracted

Family

xworm

C2

127.0.0.1:4758

108.77.173.66:4758

127.0.0.1:5470

red-ps.gl.at.ply.gg:5470

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

Mutex

xE8mXg8CRXTe

Attributes
  • delay

    3

  • install

    true

  • install_file

    Bigger.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Victim

C2

46.197.220.52:1604

Mutex

7bcbf5e23295248042b5dac9a154ecb7

Attributes
  • reg_key

    7bcbf5e23295248042b5dac9a154ecb7

  • splitter

    Y262SUCZ4UJJ

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

FEB 27 LOGS

Mutex

dwjsrlleihmlidl

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/i3NzmwEg

aes.plain

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

127.0.0.1:5552

Mutex

b13e292b915775ba092e61499e08a32d

Attributes
  • reg_key

    b13e292b915775ba092e61499e08a32d

  • splitter

    |'|'|

Signatures

  • Async RAT payload 2 IoCs
  • Asyncrat family
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Dcrat family
  • Detect Xworm Payload 2 IoCs
  • Njrat family
  • VenomRAT 1 IoCs

    Detects VenomRAT.

  • Venomrat family
  • Xworm family
  • Unsigned PE 29 IoCs

    Checks for missing Authenticode signature.

Files

  • archive_15.zip
    .zip
  • 3c7b097b31ed5df2ce6313dddd86da0f.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3c8a6c6cde2240783bed48a2f3d849a30bfa841d7cb55177721631dcec1eb086.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3ca3e4676bac76c4f7eaf0ab169b8af1.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3cb47c4bbe6856c45fd89eb5eb2723c1.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 3d18edb3bf6b0493a6572edd73f937ff.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3d1ee6caf0803c689aa17a8bada108bd515a77493a9d76dca7d55762bb6d33b4.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3d2f05086d9da9564c7c7e945875e80c.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3d81f411b0ec1ac7d861358e145db4ba.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3d90976d58eb1346f68434f0575cec2ed017a5959384e7137600668ad7777d8c.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3d97ea72c561c7d15574a99be582c59e.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3dd452b9394976fd7b431d3dbae57d18.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3dfc71cfc45034d671ac0f319bc080bd.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3e435c9ff25f6dca4a3e7262825aa557.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3e624f48a849ad8a70e09f6d4e75f02b.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3e8acfab95493518077e0028fd0f2dcc.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3e9a136b97b7ad7104019ae696b4f59d.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3eda9e4b0076b287ba224630ab1bbec46123da65410ddd5ff179c3feba113b25.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 3f182b2683bc9c0d0111113824e2a21747e0b95c1cd5c24da3ebe3cd0fab9e28.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • 3f4ee6eec9312351657cd13bf62d0fba.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3f5ee92cd3368546c0c462b444d86dc0.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3f84f670f0e10ad43bcb6df7c25cdc1a.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3faf1a47bd1cfa5b15ee60eb6073ce49e54f5512d7d778f46c7c56ad674ca64b.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3fb9658e7f678c8ff759aebcfa8b432f.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 4035e8e885f81bc3f3631b539e357a38fdde122a8df6a0329b9470f4de91fcc5.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 405e99b0ff660b0abc3176e3ce6a9e491c26056dfb2f52a1481db5456add66b3.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 4068596587c15b0367e317ad52495f4b.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 4069d5435f4e98f349a862ca454bc30b.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 406b8b1a443e6845d045b12251c7861f.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 406f4be7cc50c444e5752f9ee5209dc24c0bab4d4b3efb1bc1f39531c342c13d.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 40deebbf11b640ef6d210292c9cddff6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 40f7dd11a9192128171d410231861d08.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 40fdd7db4ab1c60f9edafbc71d027f38.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections