Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    SecuriteInfo.com.Variant.Tedy.217947.21963.1711.exe

  • Size

    960KB

  • Sample

    221006-j8e3vsghhn

  • MD5

    f3309c43b2bf62602ba5b02e1ad2dc4a

  • SHA1

    367beedcaa104f82626a112d8ffeb58fba7e07cb

  • SHA256

    310b4ffa559e06b739ba7b4d7cd12f47286aec7352a8aa5296955f0a7f49b190

  • SHA512

    a2cf7b4f080203117ded70269476c3e703942df10afccf7a138ee1e1b0212b46246a2147518339b02be943024ca6c652dabb70290831b89e0f60aa0608a89d6b

  • SSDEEP

    12288:9H5nvEeyWvXp6/rcaIdxj42SNqwgxUiWV32ohJ9xtvqeNtVQR/4ve:jvEeVR6zc3j4XSE/3tvhO4ve

Malware Config

Extracted

Family

formbook

Campaign

uymo

Decoy

A4J+j1lFUiMbPgQD0uzpdg==

F3lajp/JwxgpzPZ3bf9zrK0EzWDU/JY=

bOCwjfx/jOF4Las6GFv7+tQ=

9BDZHgUVSa1ypSWjNcPR

S9u+wp+ai+yEW4OWIQ==

wXxiP8BRWDG2JiTw5XA=

VeumNjNg3QeL/qtw

KYxbMI9RU7eqPpEYg1v7+tQ=

zwfU2Vv4NxXzDLy1IWFrDo3iqOoV1KB3

0XQ3wM3oGntH+iTw5XA=

nx7p2XIfYkHv9+Uu+VKx3l41j3mS454=

+BIOmtNni5xbAo5VEZFYQFAw

tkQa0SXOEjV/0yTw5XA=

YOLHv42Us4eMrHCod80dYluXJzNn

HZdsbBNsdAvOq+cr4CaIfg==

YlQ/0dwFQYtd+DXIxzKUlO8kBc9C9A==

mCL+zS69yZ9DyvVMC4399tE/Xk0V1KB3

+tXLkwCl2LyCqaNnalv7+tQ=

yPzM2bjLKPyixsjWSoWe9NI=

KQPQVL5puBHigv/RmyAU0ExD4GDU/JY=

Targets

    • Target

      SecuriteInfo.com.Variant.Tedy.217947.21963.1711.exe

    • Size

      960KB

    • MD5

      f3309c43b2bf62602ba5b02e1ad2dc4a

    • SHA1

      367beedcaa104f82626a112d8ffeb58fba7e07cb

    • SHA256

      310b4ffa559e06b739ba7b4d7cd12f47286aec7352a8aa5296955f0a7f49b190

    • SHA512

      a2cf7b4f080203117ded70269476c3e703942df10afccf7a138ee1e1b0212b46246a2147518339b02be943024ca6c652dabb70290831b89e0f60aa0608a89d6b

    • SSDEEP

      12288:9H5nvEeyWvXp6/rcaIdxj42SNqwgxUiWV32ohJ9xtvqeNtVQR/4ve:jvEeVR6zc3j4XSE/3tvhO4ve

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks