b443fb983556d0009bb4cd94b32d2b38ea3a34fde28a2b8f5d5b06c5b0735fb9 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

b443fb9835...b9.exe

windows7-x64

8

b443fb9835...b9.exe

windows10-2004-x64

8

Sharing

General

Target

b443fb983556d0009bb4cd94b32d2b38ea3a34fde28a2b8f5d5b06c5b0735fb9
Size

655KB
Sample

221003-t43ngafag8
MD5

04e66c511fdf2485df76cbc4a2cb14b0
SHA1

a669c062474a18e31f61dc00a4a3fcaf697b02e9
SHA256

b443fb983556d0009bb4cd94b32d2b38ea3a34fde28a2b8f5d5b06c5b0735fb9
SHA512

090c99782f65618ab0e9230846b2ab5dc1bcdf433d34819d6a819297bc6b173484259905427420241a965640bf584c4e66db68d7898c08aa5a04c37041235210
SSDEEP

12288:Jq+a9slb39XcI9TC9/1bfLkKKeXnehedVzQjRGf6DbLHAqujSIySgzJ2w7eQke:JqB9TtklkBTzQlGf6DbLHAqujSIcC6

Score

8^/10

spyware stealer

Static task

static1

Behavioral task

behavioral1

Sample

b443fb983556d0009bb4cd94b32d2b38ea3a34fde28a2b8f5d5b06c5b0735fb9.exe

Resource

win7-20220812-en

spyware stealer

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

b443fb983556d0009bb4cd94b32d2b38ea3a34fde28a2b8f5d5b06c5b0735fb9.exe

Resource

win10v2004-20220812-en

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  b443fb983556d0009bb4cd94b32d2b38ea3a34fde28a2b8f5d5b06c5b0735fb9
- Size
  
  655KB
- MD5
  
  04e66c511fdf2485df76cbc4a2cb14b0
- SHA1
  
  a669c062474a18e31f61dc00a4a3fcaf697b02e9
- SHA256
  
  b443fb983556d0009bb4cd94b32d2b38ea3a34fde28a2b8f5d5b06c5b0735fb9
- SHA512
  
  090c99782f65618ab0e9230846b2ab5dc1bcdf433d34819d6a819297bc6b173484259905427420241a965640bf584c4e66db68d7898c08aa5a04c37041235210
- SSDEEP
  
  12288:Jq+a9slb39XcI9TC9/1bfLkKKeXnehedVzQjRGf6DbLHAqujSIySgzJ2w7eQke:JqB9TtklkBTzQlGf6DbLHAqujSIcC6
Score

8^/10

spyware stealer
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

© 2018-2025

Terms | Privacy