Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
dbbd5f34648cc1a20d0022c47a6531a6.exe
-
Size
940KB
-
Sample
220920-qc8tmageep
-
MD5
dbbd5f34648cc1a20d0022c47a6531a6
-
SHA1
84bc195e56cdc6804cb987af330608ef5b173a67
-
SHA256
f8612ea8ab764a3d09157a9b90dc418ec2a7b8af22b29ce63d375896f9ec9a28
-
SHA512
6d44509bfb38afe4490034736e20dc59cd97de0a4e8cdbdddcd353f7ba5a470a1288f6a2761fa31d4c81bfdf0f6dc8cd56581e27f138e783ecea3e520d9819b3
-
SSDEEP
24576:xuLJQ0+ai+JoMCXlTjcEa0s4Tj29W8AoqiVNWI:xUpRx+cEa0Q
Static task
static1
Behavioral task
behavioral1
Sample
dbbd5f34648cc1a20d0022c47a6531a6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dbbd5f34648cc1a20d0022c47a6531a6.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
formbook
chof
1UnM9v3V2HuR2iE=
B4oRF6xBBhDKMJEdaPRiEAw0
r9++/ZEvBh3jRD0FzE01EA==
8qVuosqPI0JfNJGbZ15FT4J8Ng==
83F9+6BFk45ZYEWU04g=
aFPhK8qZoK5CUsemIC+pMoA=
hHkCihi3/HESewQJvpc=
GUMdYJRn7phVzbCTl1BDFg==
aqh5D/PNZYKH3xjDlAoz
P7NS0gXlNFVl
tS/FQFfydoZW6R2I
249T0dBwbVJp
7qNui6I3hCL3vpf5UgKVL+po4YZw
6A/tRMtieCQf/TMU1/8pJbScylADQJRwXA==
b6N1CLSByGdvSIFl6KkVYOlmEoA=
HNGX1Q3YXPxV7ceaT0w/T4J8Ng==
WwvO/0jw8ICLWo9w860VYelmEoA=
Mfa58tV8e9xs5FfhMi+pMoA=
ZOB69iIBTXJ2
EUENQq5AXeCoh8TO0BI5T4J8Ng==
gXELdRu8vHgoK4l6ToaDY0qpdJB2
ta0+dAEnNS8r3g==
VQrFVM9qqUdLS5l0RXiMcyJGO04G2g==
r+e19KJCAiYIabMvdvtiEAw0
mM+X2CgM/hPeV9YbHxExDw==
XcNh4+SnymQ7uKORl1BDFg==
WdM/cYkWX/KR46x3OHGagClGO04G2g==
EZAvpsqfYnRawf+RIC+pMoA=
i7+ABzQM1PIAbbgaLbYy9fot
qDe4BbViMVxMmWVYcfdiEAw0
QDaz5pg98wLCvaxC05ELYelmEoA=
LmY0xeSGGjM5vyh8hv9iEAw0
2AfUA5Ak+gqfNrO+iQ==
JeeW6aN0a8VFPyk=
JNmkLV467YU6G1Uh4ho8T4J8Ng==
xO2wGqQtNKx+b8iaHC+pMoA=
Pjes2krS3G5Dt/w59wTsFVDQMw==
i4kmpwfsNS8r3g==
moUpsz7hHqmJPtfMkA==
114cJsGrpkq1LVb0xk01EA==
kkAMpuCB/Asbe8ACvtKLT4J8Ng==
3NtobYxp8Ic7GBVdkCBWRBpFO04G2g==
iogankkbofjdyQ==
Pq1LrLsxofjdyQ==
woJbqLh8TolW6R2I
vSer9eC99JODPtfMkA==
Aj0Ik8OcXLN50BSK
XxvQ8yL8eRjNNBLwwQQ1T4J8Ng==
TVvoREBtofjdyQ==
SvfKCwmeIsaFdOXAl1BDFg==
7Bnc8NqfdHEcG0xmtIA=
Tm4ou0cZHMq+wQ==
oc2j6/eQF7Z5PEhOjUHnU4g=
kbt/0PENUGBv
5nHsEx7ibX594hGYIy+pMoA=
GGAZZ5Zc7eWZjnfbLC+pMoA=
nowYfSgENL7G0Uo+zZYLXelmEoA=
vjO7ODzipbmxO5zm4yZiEAw0
bhz3W4JEFznSkQiC
yTq19Rjkaw7APS4K5CZiEAw0
xHVXmkkeH0Yhlg7DlAoz
t+2+P0fcW/hW6R2I
fQGL1Nxp9AOvZ8AyegEnKGlGLeLL0g==
eN5lagri4S6g8SmK15MVYelmEoA=
saludentruiznatural.com
Targets
-
-
Target
dbbd5f34648cc1a20d0022c47a6531a6.exe
-
Size
940KB
-
MD5
dbbd5f34648cc1a20d0022c47a6531a6
-
SHA1
84bc195e56cdc6804cb987af330608ef5b173a67
-
SHA256
f8612ea8ab764a3d09157a9b90dc418ec2a7b8af22b29ce63d375896f9ec9a28
-
SHA512
6d44509bfb38afe4490034736e20dc59cd97de0a4e8cdbdddcd353f7ba5a470a1288f6a2761fa31d4c81bfdf0f6dc8cd56581e27f138e783ecea3e520d9819b3
-
SSDEEP
24576:xuLJQ0+ai+JoMCXlTjcEa0s4Tj29W8AoqiVNWI:xUpRx+cEa0Q
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-