Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    archive_19.zip

  • Size

    92.6MB

  • MD5

    91943f48b65f473f773b008f948b19fe

  • SHA1

    d905a0419e15e33664aa0f8e5cb1450a1f0876ca

  • SHA256

    ce63ae9069832ff3b0f2eb76b384c40cd8b70987280d4cc07559493a2b5c04ff

  • SHA512

    15c4e255854a9d32f5db9a65ee586475ac29ee26d8d08cd203a84153b6a4b72326705c4876fd0313b727cba35286749d614aac1545c995d1f6f3e38c3c76ddc6

  • SSDEEP

    1572864:R00oDoL7wxIKaTH9reQLyeQFhn8hAVnIioVFORvcg0XUEHhFGkAid4XuK0fRkyQm:doD87wxbaTH9yQ1Qo4+nORgkAHAjuK0j

Score
10/10

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:4758

108.77.173.66:4758

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Extracted

Family

nanocore

Version

1.2.2.0

C2

georgestephensfurry.ddns.net:4444

127.0.0.1:4444

Mutex

9cf8c1ef-c568-4176-950a-5eb6788fc62d

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    127.0.0.1

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2020-04-12T02:28:08.602442236Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    4444

  • default_group

    Big D

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    9cf8c1ef-c568-4176-950a-5eb6788fc62d

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    georgestephensfurry.ddns.net

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • DCRat payload 5 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Dcrat family
  • Detect Xworm Payload 2 IoCs
  • Nanocore family
  • Xworm family
  • Unsigned PE 23 IoCs

    Checks for missing Authenticode signature.

Files

  • archive_19.zip
    .zip
  • 4b5d342b8c5a5b19fac86b1315802786.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • 4bb452a3de5825053bceee8fd5ee6db144ef8c4615a71a8408ee7de4df789fa3.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 4bbf1f33d0196e9a4ffae1877690bd000c7f728d546252ced45e60ecfe25e04d.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • 4bc17871c10bb28c4e2b5e2f1d9e4664.exe
    .exe .ps1 windows:4 windows x86 arch:x86 polyglot

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 4be84836f68985fd15cbf992a7b0e782d1bab4439960e27c6e252e76a89ce2c8.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 4c2f38b99403c4aaca4e0a524b094c17b8d7b462af1041dee9e7562c512af4d5.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 4c948e42267877c379b01be5faa66926.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 4ca1d61a2465b19118d75478ec45e38cf03e101fd7422cfb04e4a526251ac92e.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 4cc3e6fe699a661d5a6ea786a93cfacd887570860b351476e5f5a1d3616bf922.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 4cf97069999c57b9ff02fc34f4efbe8e.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 4d8cd82fa6662df02eb5af2abbf815d5.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 4d947659fef83a302fd6b7451b980b19.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 4dac62ad007ffed0e0d4b738af6da8ec.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 4dde57eed00149aa841c1408694ff4614ca0f5c17c6b4ef8040bef7639be857b.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 4e1fdde317913d69f35aa03397b5ded3.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 4e248cce2fb9b5f155ca62d21c6e9da7.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 4e6c7f9caf5dadde4be08894f18041d2fe6ea67459012b3a6a1d5d9638896580.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 4e800300161ff13b85d56f1489e00ae11e0d06ed116cd09f736e1641c185b2df.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 4eb673e9ffd59e93f3459437eff54393b9e95872f931d4f50150a6bd6d194a3d.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 4eea2aae24586dff7991d201edd2e266.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 4f0c0be15c331ed309877692735a28b38d886baeb15cd39110e1dd3eb5a7d9d4.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 4f2a4c792cf530f358362ffa423c1abc.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 4f45c05629c1453e2d27f42cde051d59.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 4f55ad00b79fe8bd58bdf68b8ff7843b.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 4f5d0cbba4d9d2f0e3e90ce8c06730c1e272d8d283b18ed60c1939f86d3503f6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 4fdfbb239de16fb7275a4246ee21f87a0193a6f2fbc4692a347e7e9248d1c1ca.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 4fe9a32f770cd40fa9c7f1cb29bddb04564318b8497f27cb9247b29a90fbd6c6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 4feaa2d6562d85771c4bd7f5bc9301a8.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 4ff330be569edd8a1e2c8cb830402aaa36ac99ab3b7ec0036fb005f429a3e5ac.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 5010ab604323bb47b9927183cca0489b731b1113f9e3da23b207f102f3e6f9a3.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 50250d5dd4c7e594ba5dd306741d13ad80226650173f116cf04909a84ba2bdb6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 505ad329ffae09dffaa01f2bba981e2f945146e1ae5d69334429c84bc89b2d58.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections