Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
87d7ff8b72135b868019c4272a2a78b8f2a60c4fc349a8b90cbf05d14db130d8
-
Size
1.8MB
-
Sample
220915-lcf2dsgcdk
-
MD5
19dce32b6b36444cfdb97ec6a3cb3bb8
-
SHA1
c42fc0be9d6de8f1628770cbf871af61579878b2
-
SHA256
87d7ff8b72135b868019c4272a2a78b8f2a60c4fc349a8b90cbf05d14db130d8
-
SHA512
b5bdfa91b0992837a8a595daaa44268cb86609d33f21eae96916a7e845aafcd123f59527bc17227034979ab0cac317bbe7520da8235dd7ae69390f391401a458
-
SSDEEP
49152:2Lp7NcqZzzGDAXKd+2ip4+LANMwUMCONXJcjGA:2N2qtzrN2EANMLwNXJ8GA
Static task
static1
Malware Config
Extracted
danabot
103.144.139.228:443
213.227.154.98:443
66.85.147.23:443
153.92.223.225:443
-
embedded_hash
A64A3A6ED13022027B84C77D31BE0C74
-
type
loader
Targets
-
-
Target
87d7ff8b72135b868019c4272a2a78b8f2a60c4fc349a8b90cbf05d14db130d8
-
Size
1.8MB
-
MD5
19dce32b6b36444cfdb97ec6a3cb3bb8
-
SHA1
c42fc0be9d6de8f1628770cbf871af61579878b2
-
SHA256
87d7ff8b72135b868019c4272a2a78b8f2a60c4fc349a8b90cbf05d14db130d8
-
SHA512
b5bdfa91b0992837a8a595daaa44268cb86609d33f21eae96916a7e845aafcd123f59527bc17227034979ab0cac317bbe7520da8235dd7ae69390f391401a458
-
SSDEEP
49152:2Lp7NcqZzzGDAXKd+2ip4+LANMwUMCONXJcjGA:2N2qtzrN2EANMLwNXJ8GA
-
Blocklisted process makes network request
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-