Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Attached Documents FYV#07072020_pdf.exe
-
Size
371KB
-
Sample
200707-5bx1edryns
-
MD5
b5de70712b8019f5209ea76c30d8874a
-
SHA1
cf50c5c5ec01f992ce869f6f564d355426f81ec0
-
SHA256
50823ae6e2e1cdf7aeb3fa1e9398ef0f5f7c244d22e3a1fce261aa0836bd02bd
-
SHA512
872324c5e4e701be10af8c6f392578b5b5d8e5166ba068d5c5553e0cd899835e443c6377d747601b269b066bded5896fec3d2aeadca1f76add2cb73f51849886
Static task
static1
Behavioral task
behavioral1
Sample
Attached Documents FYV#07072020_pdf.exe
Resource
win7
Behavioral task
behavioral2
Sample
Attached Documents FYV#07072020_pdf.exe
Resource
win10v200430
Malware Config
Extracted
lokibot
http://beckhoff-th.com/chief/chief1/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
Attached Documents FYV#07072020_pdf.exe
-
Size
371KB
-
MD5
b5de70712b8019f5209ea76c30d8874a
-
SHA1
cf50c5c5ec01f992ce869f6f564d355426f81ec0
-
SHA256
50823ae6e2e1cdf7aeb3fa1e9398ef0f5f7c244d22e3a1fce261aa0836bd02bd
-
SHA512
872324c5e4e701be10af8c6f392578b5b5d8e5166ba068d5c5553e0cd899835e443c6377d747601b269b066bded5896fec3d2aeadca1f76add2cb73f51849886
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext
-