Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
41s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23/10/2022, 18:16
Behavioral task
behavioral1
Sample
2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
Resource
win7-20220812-en
4 signatures
150 seconds
General
-
Target
2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe
-
Size
4.3MB
-
MD5
47a77e0680b5e159c610392034a8b905
-
SHA1
ab53d53a1878d2e441671a50fe25c27c98c27745
-
SHA256
2461acfa271f7d477ca53abe428d6adde1f285e115f188b2c82e321a94271a93
-
SHA512
17fa2068607b8777707a3194a6103429b3281ee5582525f60b036d396b42405b8eaa360af0d8551e61962cf69bd0fe9d0c4785aef5b5053af5cb7d25e12ada3e
-
SSDEEP
98304:GcPvZKq1eSV1mScVkFwPSfHbTLpSjLfiW+mp+pG2a0sJs0Uz9Fy:GcPRMQ8r6f7TLAjLaKApG2ab6Bz9U
Malware Config
Extracted
Family
ffdroider
C2
http://103.136.40.167
Signatures
-
FFDroider payload 2 IoCs
resource yara_rule behavioral1/memory/1044-55-0x0000000000400000-0x0000000000A32000-memory.dmp family_ffdroider behavioral1/memory/1044-56-0x0000000000400000-0x0000000000A32000-memory.dmp family_ffdroider -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1044 2461ACFA271F7D477CA53ABE428D6ADDE1F285E115F18.exe