Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

52088快�...��.url

windows7-x64

1

52088快�...��.url

windows10-2004-x64

1

wg.exe

windows7-x64

10

wg.exe

windows10-2004-x64

9

歪歪外�...��.url

windows7-x64

1

歪歪外�...��.url

windows10-2004-x64

1

炫舞邪�...�).exe

windows7-x64

10

炫舞邪�...�).exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2ca928d86351bc2a1d27cf238b25b301f65825525a03623e10bced87ea0e1814

  • Size

    2.3MB

  • Sample

    220919-eswnfsfeh6

  • MD5

    d0715cd8d59ae69f85582cb14e73e723

  • SHA1

    e698c6995d6abd6e27f7e4bc580a971f3324e03d

  • SHA256

    2ca928d86351bc2a1d27cf238b25b301f65825525a03623e10bced87ea0e1814

  • SHA512

    a46c3847fa02e222845021fbd5f1bdafdd200c0d5c6f5e49b8662bf34427b528d5ce0726db0b550583727941133bf78b56f78b64ada6574587cfc9814a7b2185

  • SSDEEP

    49152:+1ja3MxwZMHsK8Cw6H0oQ7JriFzKTStRq99Dxg/s5UmYvOZw3pXN:MIMxKmsNCw6H0o6riA+I9t2sCvOZw3pd

Score
10/10
jokeraspackv2evasioninfostealerpersistencetrojan

Malware Config

Targets

    • Target

      52088快速电影网 - 百度影音电影百度影音电视剧bd电影bdyy电影.url

    • Size

      118B

    • MD5

      c5f170c9c5e3816c879c47decf19db0f

    • SHA1

      1b8783ed677b5348f9904f788e1ae8e95f27ee6d

    • SHA256

      c234a8e2f305247964741e18dfb8fb652ce6241027eb0aeffae2f2f946d3dcb9

    • SHA512

      445d80253a30e4f880e167adaf69f9b7bf03f590cea7616d4283a052d958a308c162e4b431c5e4fb4663953decc3eb49722680c592334b5de10d80a5abf3e55f

    Score
    1/10
    behavioral1behavioral2

    • Target

      wg.dat

    • Size

      2.4MB

    • MD5

      7c456017d18bcd67d119b1852e10ea9c

    • SHA1

      96fbe0db6d5730d5fda4cc3ee41c5b682a0ebb17

    • SHA256

      61f70c121d427e2a7b2e70937b13099163675b51af23d0b0ec87ea312f021d95

    • SHA512

      75f6e33dfc3ed694865710cf946789c2f1923bb70b6d8fe72f4ed0e32f315cb126350d7c1bd95d16d3f179b21d5b52583fb18e3ac4618a3a0bc42d32db7b178b

    • SSDEEP

      49152:6000irolqOGH78ChAaqBi2tSiDLz/FX/8zptVu25IkyjGY:f00i8qONCOaqBiqDLz/VUltk25Iky3

    Score
    10/10
    jokeraspackv2evasioninfostealerpersistencetrojan

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

      infostealertrojanjoker

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • Modifies AppInit DLL entries

      persistence

    • Modifies Installed Components in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral3behavioral4

    • Target

      歪歪外挂网-cf外挂,qq飞车外挂,dnf外挂,qq农场外挂,qq牧场外挂,qq炫舞外挂.url

    • Size

      75B

    • MD5

      3505b3b1a987e04ad9441e7896a01663

    • SHA1

      c591978b2c92ee2ffd4d456adada2ed526227d4a

    • SHA256

      25244f14640a506def9868d589b96306a1cf238d1785538d9adda7d08f085715

    • SHA512

      52e96344d0ab0bbf5c84d28cd9e1ddefc4c63231a54ffb3c57a9c96a977cc8e8a91787bd24abe2c7f597a719055371e6fa0ba775452c7b9e7555530ae575c661

    Score
    1/10
    behavioral5behavioral6

    • Target

      炫舞邪少助手3.0.9-1.23A(心动增强).exe

    • Size

      28KB

    • MD5

      f3452d3085e3eedd20cf6b1565145224

    • SHA1

      6c741a53e359015ddf5a4a431ac21d2bb5892dd7

    • SHA256

      bfde8378737709f7652a1dc6036b958e1c9a067b74595a76f2a0c1a2048d009f

    • SHA512

      65fbf8aa8f9a2a9c87e18fea0ce968910744f834da94f47d281dcc88788989b5fb704ccbb0be74f95b1473c5464bb3c8a97419fca9c6e5b43c3ff0d1746511db

    • SSDEEP

      768:Ytjyjw5eEVPstTlzM+YnQozV2LFxU2HUs:8l5sHuQosXUIUs

    Score
    10/10
    jokeraspackv2evasioninfostealerpersistencetrojan

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

      infostealertrojanjoker

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • Modifies AppInit DLL entries

      persistence

    • Modifies Installed Components in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral7behavioral8

MITRE ATT&CK Enterprise v6

Tasks