Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    archive_30.zip

  • Size

    41.1MB

  • MD5

    6f02cc61cb8945dcee48265ad6916e5a

  • SHA1

    eaa411bb33a94ae4615468aa45722835a69babd0

  • SHA256

    ec57a5693533b024615c157ec0e3867b2eb73a65a12c20501ef8ff00ffd8f65c

  • SHA512

    44a16e25b997d1efb8bcd57d4457da7ef4219be559dcb7d41d2ddd1704442088b43ee38d8a45ba1babd8f5e3893b80b61faa07e57a044d75f97782beb88b0a5f

  • SSDEEP

    786432:fbPaTBnwiKgydYEQ//yxNMPaQ7s6uHumHAkX3WfYMKVYFMWIPc8E:fbklDEEaYtgHuoHW+VYruc8E

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Headr

C2

error86eg.ddns.net:1177

Mutex

d5c29d22d9fa14b1dd7cfd15d962944d

Attributes
  • reg_key

    d5c29d22d9fa14b1dd7cfd15d962944d

  • splitter

    |'|'|

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Office04

C2

5.178.111.227:1604

Mutex

QSR_MUTEX_bpq5GgdeRU1mv1bJt5

Attributes
  • encryption_key

    6GhQeBE4Z58goiq8LNT2

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Extracted

Family

mercurialgrabber

C2

https://discord.com/api/webhooks/1288901667378696305/Ld3vx4JK5uthMQySWRKj1BbYyngn7jZHuyKNgQFZYluhp1VI2lWyMrfi3zxaVADYWM2s

Extracted

Family

xworm

C2

<Xwormmm>:22

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    taskhostw.exe

  • pastebin_url

    https://pastebin.com/raw/PiG09ZD4

  • telegram

    https://api.telegram.org/bot7087178461:AAGD_ZY09vmL3W39007S6ZEOLHQ-pPs8p0U/sendMessage?chat_id=7046939751

Extracted

Family

njrat

Version

Platinum

Botnet

HacKed

C2

127.0.0.1:9509

Mutex

Client.exe

Attributes
  • reg_key

    Client.exe

  • splitter

    |Ghost|

Extracted

Family

xworm

Version

5.0

C2

china-limit.gl.at.ply.gg:4435

142.202.240.81:7232

192.168.100.13:7000

178.173.236.10:7000

Mutex

JDPgKbiXEJ3NhlvV

Attributes
  • install_file

    USB.exe

aes.plain
aes.plain
aes.plain
aes.plain

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

Mutex

ZMJtqae1O6kd

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

137.184.183.22:4782

Mutex

3531a325-1303-4497-bbea-4f44f2c7a574

Attributes
  • encryption_key

    153F6334E2592BCD4581017D1E90F4A135DE3834

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

sun-jpeg.gl.at.ply.gg:6021

Mutex

9e886a778412862a9d382f947b7bccf8

Attributes
  • reg_key

    9e886a778412862a9d382f947b7bccf8

  • splitter

    |'|'|

Signatures

  • Async RAT payload 1 IoCs
  • Asyncrat family
  • DCRat payload 4 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Dcrat family
  • Detect Umbral payload 1 IoCs
  • Detect Xworm Payload 5 IoCs
  • Mercurialgrabber family
  • Njrat family
  • Quasar family
  • Quasar payload 2 IoCs
  • Umbral family
  • Xworm family
  • Unsigned PE 28 IoCs

    Checks for missing Authenticode signature.

Files

  • archive_30.zip
    .zip
  • 7a78d3faa8bb1e60b3300959a55559c0.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 7a8104b16eebe51954a83ce3ee440b125476d3222314a3cbba247ddf77d62b22.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7ab705f224e5e7c9426f8602ace00f05.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7adc287e958d5eb62246c2714f59cec9.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7afc023a5e75b3afa7bbb2091a6170dbc3c895858f38ee5016dc1fa63e71a41f.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7b5101c9122edf393eb01ae2e8376ff4c068ae90480c777e1d5e671b2d2b61dd.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 7b545826d4c80e7dc461ebae6c6dd9a3ddadec34a907d988744a485390bd6d54.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7b61ae4f030c2ff2d514149d23e413fd0ca5044e4330887faebb33446b4e4792.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7b7c0c824b8d7f5dcd61ecd49ef48352.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7b9f7b540f1d1f808cab1b3a24e97d84.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 7c24c0692aeb64f8cab8de418247bdea.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7c2f113ba8a501582e5be7ba0c0bf0fb.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7c8b7f048ddf08182db2824fff38e73e.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7ca42dc286ca99ecb75ab26cc68042f04556b199feb0ecdece718faf13b8de36.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7ce67df193db91ca606ca62cfd5ffef2.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7cebdbe487a669e8a1bbd5c09ed5721d.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7cfaad65c410dd3406ac290b683c86c5.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7d0e3ef0738f4687ee07ceb68b42da5d.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7d27416631b1e50c46ce5e91baff6e81.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7d51f39af4a18f947afd0e0f2aaec347.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7d60f137ef308c08065ea99a9ec6193a5bb81126430267e0e88c43ac2804c206.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7d64c7a9c71934cdd393dca1aabdec7a8848e85a1b4cfea040d7570f493d4608.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • 7d89bf804c092b9f318ddb39103df719.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7dc3b083340715994c324366358a1db5.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7ddeda9644eefe9b4475af5cc0b39fa663379d0c73ce6f38000cc9fd339c8091.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7e1ec477acb85758eb90b35319cca956.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7e4e713018dc913b1ec53fc59585e913bded061b270226945f5d8170ce5d3c29.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Code Sign

    Headers

    Imports

    Sections

  • 7e514b39f29ecc6c3221973b54e9ac10.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7e58fc023d8fb3a0aed4ffa550bb220e46cb17d1b2dd6dd8bf708b6d571ae92d.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7e69682d9a34f282c34ecbca3dba377b.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7e813e26f8bfecc125db784dcee4fffb.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 7ea246058977990fa8d404d8106c8c58641d848169f93be8714da992ac8b4eee.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections