Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

4b8bc86b3b...6b.exe

windows7-x64

10

4b8bc86b3b...6b.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4b8bc86b3ba5dd3fb7ad3ca3f3f3e62af0e13679c3eb8cd630d36b03eabf7f6b

  • Size

    1.8MB

  • Sample

    220919-esjnwsbfdl

  • MD5

    5017e4642ffb6fed42235d37fab16273

  • SHA1

    91a00dfa17737092c79cce3002f6d428c4b47ed2

  • SHA256

    4b8bc86b3ba5dd3fb7ad3ca3f3f3e62af0e13679c3eb8cd630d36b03eabf7f6b

  • SHA512

    71dcb7efee14707a70e32c11d40b798b8a70f17b81548b52f67213bf2767d1d6deba570ef9b2668bc26c362964c9f5364af8ad88593e6d001627a0f83e28e058

  • SSDEEP

    49152:GZp4kJNahggTdaVS8wzZrhyL7Y6Xl55PA8DXl5IkyjGY:GZ+gMhfdaVS8otyw6r5PpDV5Iky3

Score
10/10
jokeraspackv2evasioninfostealerpersistencetrojan

Malware Config

Targets

    • Target

      4b8bc86b3ba5dd3fb7ad3ca3f3f3e62af0e13679c3eb8cd630d36b03eabf7f6b

    • Size

      1.8MB

    • MD5

      5017e4642ffb6fed42235d37fab16273

    • SHA1

      91a00dfa17737092c79cce3002f6d428c4b47ed2

    • SHA256

      4b8bc86b3ba5dd3fb7ad3ca3f3f3e62af0e13679c3eb8cd630d36b03eabf7f6b

    • SHA512

      71dcb7efee14707a70e32c11d40b798b8a70f17b81548b52f67213bf2767d1d6deba570ef9b2668bc26c362964c9f5364af8ad88593e6d001627a0f83e28e058

    • SSDEEP

      49152:GZp4kJNahggTdaVS8wzZrhyL7Y6Xl55PA8DXl5IkyjGY:GZ+gMhfdaVS8otyw6r5PpDV5Iky3

    Score
    10/10
    jokeraspackv2evasioninfostealerpersistencetrojan

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

      infostealertrojanjoker

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • Modifies AppInit DLL entries

      persistence

    • Modifies Installed Components in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks