Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    archive_34.zip

  • Size

    41.7MB

  • MD5

    52863353008c72dd65ead6788ff8a2c8

  • SHA1

    7e54970322d38a9fb2c93e77d7cc4c45c0201f42

  • SHA256

    189c456c653e587b81b4f3950b102a94c4570c2a7057c50b138b511162a2c46a

  • SHA512

    d081b7845e8b4223da2847e39129e9a6532cb09e6465f5abb9d5c37de41fe01a072c7cd0d41ea09325583fc84349d2e26d786fbbc435ed96445eb34421529c61

  • SSDEEP

    786432:2sjaOAUL2PeUzZh0WwWI1lV/z/pDhJfgASJCkmS8//yxNs6cF2mo42sb78L7FCV:7joUieuhjObz/D5N9k4a3cF2L4zoFCV

Malware Config

Extracted

Family

xworm

Version

5.0

C2

third-gained.gl.at.ply.gg:6498

Mutex

sqpNukyZ801PsE3K

Attributes
  • Install_directory

    %AppData%

  • install_file

    Startup.exe

  • pastebin_url

    https://pastebin.com/raw/7PqSDzWd

aes.plain
aes.plain

Extracted

Family

xworm

C2

document-wonderful.gl.at.ply.gg:40393

xyxviebet-47701.portmap.hos:47701

Mutex

8VHClCx94hFKnvLn

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    USB.exe

aes.plain

Extracted

Family

njrat

Version

0.7d

Botnet

H2cKed bY TaKsHeR

C2

z88.ddns.net:5552

Mutex

63836c251750e788af0d3ead7ef4cada

Attributes
  • reg_key

    63836c251750e788af0d3ead7ef4cada

  • splitter

    |'|'|

Extracted

Family

quasar

Version

1.5.0

Botnet

ratted ig

C2

skidderonthewaytoskid243-26149.portmap.host:26149

skidderonthewaytoskid243-26149.portmap.host:2560

Mutex

9671ef23-3156-476e-9345-21d9831c36fb

Attributes
  • encryption_key

    005318B10F061A7C11DF9796A527D8C2068CEB10

  • install_name

    skid.exe

  • log_directory

    Logs

  • reconnect_delay

    1000

  • startup_key

    RuntimeBroker

  • subdirectory

    Iskid

Signatures

  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Dcrat family
  • Detect Xworm Payload 4 IoCs
  • Njrat family
  • Quasar family
  • Quasar payload 1 IoCs
  • Xworm family
  • Unsigned PE 25 IoCs

    Checks for missing Authenticode signature.

Files

  • archive_34.zip
    .zip
  • 88bc7b6a627017c4f048d13e756f27b0adc94dc25d0b53c42a2cbdac36177600.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • 88cdf3a075a9f38022db50379cd5771e1992a58af68f516812b40c8320dabc59.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 89000a0d0047c48b96288186968f343d17f06f470b2985cfdd4ebcf56f9efe5b.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 89270d6b49877a5303ff4416c74830b4.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 892ac0ac36d3e692e581bde711ae2651.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 894b900bb7817bc5ddd0e3ad48eb9c6fbe4ad9ad7741358d311bafe03b988a92.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • 896493118eef774a76d4ea1ef6ead5a805b0d99452a2c423da8c617c459f5b17.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 89652cefa9366ca2d97d0e0b49525984.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 897255af3577597d102569ae36e4a05af7c024eaaaf4b26d4515002d2b257303.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 897b60be5611091a83c5ceb48f7d2bd4.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 89a1a21003baf78498607da9565222de2ca042713740ff1005123e24f6b2449d.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 89ed231ad61a9e5a7fd0ab9f2bd75b9a.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 8a4e1b5c2998360f622e0279dee68fb7e7130c4a0fa23749b404f70c10dfcd83.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 8a7ce080bb43fc3edf2ddf3b300355ba.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 8aa071d8cc2dd74176f041bba8762b3d.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 8acb86332d3165ca0750e27ecd4b4948ab35ade98d43820de667e14ff849c64c.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 8ae0977e3090510ec1fcd29e451e8a30.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 8ae0faef18593f02adcc504cd6da1a9e.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 8afb49ce13c9e9aebbd4ae0eedf0987b.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 8b0013949b0c0dc1713c4890f90b37b9.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 8b11a49e7a6511d1938d09a2d14746bd.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 8b33890058a48ab1ef47435d91d9e5aa.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 8b6a29e42520156ad92a4b76f80928a3.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 8b780967aaf83eb23c0d64f611f066e987709b8b6bdd9c8d113a7fbb443b8ce8.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 8b815770d8fe52f863273b3ddb1d1f3a.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 8bb31982b288e0e7afbd4276768ba0b9.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 8bf9f05e59b154b0f90bd499925419c7.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 8c322ba944aff39a35b91396d64031b3.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 8c61c937b0782af9f0109012687c8c9f5c56585b539e3e9ecc26791b9dc7ecaa.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 8c68025f4588b08f130a4225136fe3f90cd4f615e44b1886529e8b6c07d77a57.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 8c6cb0e210d68b1c97427043ff9efad12f33c9a662ba3f091147d070e0ff9f76.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 8c909ef23e1fad215c6a8e84753aab0fa53127bfdb35e936266abeaaf48f73a5.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections