Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
dd69b061183f077c1da484824825df5e3fdfeb72ff84f214ef4395e9eeb4668c
-
Size
514KB
-
Sample
220929-c8drgaheh6
-
MD5
519e293f970182a09ae7e28204c573f0
-
SHA1
99217379e9484aa91ab638092c1e1ee335aacbee
-
SHA256
dd69b061183f077c1da484824825df5e3fdfeb72ff84f214ef4395e9eeb4668c
-
SHA512
6bd675e923604f75c39439c9240bb41b172fdef83661309575f0c8d207a39e410ff54d33d1a62fa58194d1af42ea2f3d024ae82c425214c8a944cf6b51826ad0
-
SSDEEP
12288:MCImHdI7Lmhxqo7IwFOnLTMSMmAZIY2On9PcrNKKz:LIqd8ShYjwM3ImCW
Static task
static1
Behavioral task
behavioral1
Sample
PI_美金匯率28.84 (USD 40,257+5% 稅).exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
PI_美金匯率28.84 (USD 40,257+5% 稅).exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
lokibot
http://sempersim.su/if/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
PI_美金匯率28.84 (USD 40,257+5% 稅).exe
-
Size
610KB
-
MD5
ef27f948191d40a2549d4c3bbdbcf2d4
-
SHA1
03051fc970c92072b411735b1c1b4b5193a9df71
-
SHA256
b134249b75a8caee01c1bfa696bbe1b6ff5029322ebf2904a18107c3fce6bcd2
-
SHA512
c25f7843f48efa4cd9c6e559c9447ea69a5773d35f3bbf5479fad38b94c5f6d4dd5a1267ef5c7c8a36dbfeeb6f0ac260c8f166f4cf85f843f9a0ca16429e2782
-
SSDEEP
12288:rSqg5SZF75eKlIwTOTLHMSMYujIYCgV9mip02L:/ZZ5wwMTIY4gY0G
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-