Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    archive_14.zip

  • Size

    49.2MB

  • MD5

    c38f3bc54b8e04ca733d80b5ac961685

  • SHA1

    bbfc5a44f6828039314f9fe91f37ef19de34ac69

  • SHA256

    5b1a883fc342ab1654912c119190f04771ae47477f1a006b932150129675134c

  • SHA512

    6317e525bb05a934c4560a24ef8d3cf9be6934e1c0466552f85df4e44a6f0e5d7544c4422dbb52354346b743151cf21eeb7dcc6b4060cdfc2a2e4f920a0188c8

  • SSDEEP

    1572864:0NJXJwm7LVvArT7fbmfZoGaBWeQMjGndafAmakygy:0NJSm0T2f6GkVQMjGdfmaV

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:51521

santifzm-51521.portmap.host:51521

cartomen-43567.portmap.host:43567

Mutex

b72MvNSRMPJDN4rw

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

aes.plain
aes.plain

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

C2

127.0.0.1:5050

127.0.0.1:3368

147.185.221.27:5050

147.185.221.27:3368

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes
  • delay

    1

  • install

    true

  • install_file

    Update.exe

  • install_folder

    %Temp%

aes.plain

Extracted

Family

discordrat

Attributes
  • discord_token

    MTM1MDQ4NzQ5Mzk2Mjc2NDM0OA.GZbvyA.PKNFIhetpzF95YcuCNgq7R2v-BQBC2fehZx5cY

  • server_id

    1350487296222171147

Signatures

  • Async RAT payload 1 IoCs
  • Asyncrat family
  • DCRat payload 5 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Dcrat family
  • Detect Xworm Payload 2 IoCs
  • Discordrat family
  • Xworm family
  • Unsigned PE 25 IoCs

    Checks for missing Authenticode signature.

Files

  • archive_14.zip
    .zip
  • 37b5b3a3044b6d582546b772fa8cee08.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 37d3fcd5058c45d2c2bba065a5c22296.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • 37e1fc1ec800f44c686bd7c2ea3c8890.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3806b87b2562c44df09560409b8759bae8ba6dbe918fe9020f61088360cb99f8.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • 3834ae494af0fd48ecc667bea1ef47cf.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 385f35ff50b3c39fd02425bb9baf09a100e555087c6dedafddcc98052d8f703c.exe
    .exe windows:5 windows x86 arch:x86

    7a25240705d7070e2a41d13d53e26b29


    Headers

    Imports

    Sections

  • 38e8b4b1294e5d3ddacd9be4727487cf.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 38f5cbcb2feac76366e60af6e81dddb0732c39c03b973fcc158b0838fa545ba0.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 38fa74b5c6f3bc1f8061998ae2d881d1.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 3925d50ec09cade5278e78250a503852.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3941105d7c81e962f92d2023da9ec9e6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 394f64ff5b12eab1067babefe641f23e.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 39813551d3b3ee13a718ee63b2d63dec.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 398d0de7a9676d640f72d3e865a704c9577be0e57cde62434a628ed88dccf79d.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 39a387cb5e2530237c32fac8504faed4b43ca4929459af88a9362697f2f9172f.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 39a7f02d9e76b2b1d996ec00e73d9e5ad7a78380e50bf46ee013df73a37a10aa.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • 39c82ce06f0eb811cd052c68db93ecb7.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • 39cc25b930558ab5b4677ec97051d064.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 39ee436cdd476f0056087db4192a136e90c17ae180b1381ec9c9ceaaf8bcce63.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3a0eb86790e5d0893114bd69f85f4dbc.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 3a20f418c4a5d544f949508f591347f6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3a28997d9ad21018ad9faf63aec091ad8840edac8691effe99469a3067e3cd09.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3a2944c019f6ca14e2662cca7df598e0d9bf29f3009fdb8ad95429cc00a4a9bc.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3a41fa4b2c0ee6478aff8120bd99da53.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3a4fbae7c2e2878a15c3a7c0d23123e788f16c7b50047584fe50596d6c9c5479.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3aff860cd9f0c72da79a1e57db08dafe9e71c2c5c255d10c1ee945b52ddd99c3.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3b2da0275b006a9a52a96a8ca5d2b9e1.exe
    .exe .ps1 windows:4 windows x86 arch:x86 polyglot

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3b47017e99879c8f391c352b16bf4abe.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3bcf0e562a651b7b3d1b9557a163082a75830a4e7d64a0d1692b4fc4ec090779.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3bde0ca6af2fdafa11318d70fb98ab40317b3146afd9a910e9ec8048008caed9.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 3c3d726e3a0da90733752ee664a40a8d.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 3c5e61912d24e049067a60123e74866f5cc2589af2a4c2a95119dee1e7f11412.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections