Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
mary.bin.zip
-
Size
28KB
-
Sample
221027-3qq7ysechk
-
MD5
1e2f3bee32401d913b39df985cbc4ca8
-
SHA1
4536675b00aa1967474bf3e2a97c55374e6e8439
-
SHA256
049549f50f5dd8774148408e909bee0ae120ef176386ed3857ed77c9b52e6667
-
SHA512
2a8b55a6cfd98aa8c5c710af62ccb7ff49eaae87492a9f3f04c54e3cbbcc2e683d5077e07e38fac84f6061f54d1c103ae363b31bcba55d789b50f0dc98a84543
-
SSDEEP
768:eg3bUOYujciJyndDG/muopy9Nrg0bG43N52HHrM3k:iTuAiJoyZ3rgJ49Cw3k
Static task
static1
Behavioral task
behavioral1
Sample
mary.exe
Resource
win7-20220812-en
Malware Config
Extracted
formbook
bbuy
wqbqKCTkCwjtbad3vwJI6Z+a
EqD7JRhUV2ZQDnU=
UlWd0LffZzZeGY0BzkxroA==
sAbXk3SNlPOcRleKI+k=
HCpzqZKnJGDpf+qsxnOnvQ==
vGdG6Ezu8mctzfLnmX/FLDeiPS3M
tcctT/pPwrv7mdA0aw==
Tr6fUz4Ae0mrGA==
NxZtBUfk3aqxS1eKI+k=
TSUVzyy9hBs65j7xXSRVBx+M
fObBavCu4OEt/0pTr98J
2ap9Oy1p8MQP+EtTr98J
FL4Q0TXr1iHWjezVUdQtFT4=
kSFvf2KUliCDOWwacw==
ctqtSLZvqqr/xym6xnOnvQ==
8DqrrnN58fVC
fIrZCP4xwLt7CkGppluStw==
PFKUNZxcpLCtk6yjMus=
4CKOs2UMhs9P8EvLAXO1Hj8aNA==
0pEGOQOa0+SOV9AnYg==
qnDL6Mp+sL8W4CBtgbr5mmBu/BqoN1ksrg==
odQl1SvDIPk+MKbXqZfAxjdUZ68=
0Q8qhE+olFU=
WROEuZebCNvW80h5
h0y206dprMCvKLI4dv8ZEIted/zWuis=
XmZVAHxKyQ6rWboZFTdzGiDPLD3X
4V0534kw+m0tS3IudQ==
VW7HBe4GhtdGQpESaA==
6PRhiTetWC9f
TS+Gro2nN/ZgFm8=
wYLRnQutWC9f
xRpkKxw9tvyJJ05Tr98J
dnI90o62MwPdTqrWj5DJhqNg5QKkHW0krQ==
TZ7qiOquIOolB1JTr98J
an1eJRfZJSVLBEdTr98J
scbjg+SR3pwg8Cto
WJDNb9FuJbGBV5ZT10jM6yc=
3qWvw6zJe0mrGA==
RwJjfSnOxEqNKHY=
/369ev4qJSgTxSQafQ==
Arnyf3Qkl5NZ7zZv7Vqevw==
Vz+fGoISw0duIIM3dw==
xDaCJHZ4r0e+TZS78zhroA==
b74OqQq5JP86FDOrSfY=
bypvPjLvpu++Bewi1bwQRevIHhEkWSM=
gP/GfV98fUJL4ElTr98J
1qN0EnUJe0mrGA==
YhpjEWoZIeCOV9AnYg==
pyJykXi39H453yQgszKnTDqP
nPrtpRfi3D0G5kANY2VzZMk8ybWZA9vp
2/CILeCtWC9f
PUslsw+zEOze0hJg
U6mKVCtHTJc/AnqAPki2Iz6S
R+I7YVVpN+VI
LipwL4MgDmcYuONcSX2HpA==
Bx9LcVFpN+VI
LKiDNqxuZDJhGSpkHwInyRVC34jG
jyJreC7ZqDUG4hiV4ll+lfMoSqU=
qimAUsCWUV6jcK/e4BVH+CC7DSfO
Yd0uY+yRzNyOV9AnYg==
TGRP34usX2KRj5bVq7kA
HIZkGxBDNPOxf70v6J3HuA==
mUSrYyQ4puqAGok+wUjM6yc=
pzkdrg7Hrvirb9PEDAMcDDw=
take-solar.shop
Extracted
xloader
3.Æ…
bbuy
wqbqKCTkCwjtbad3vwJI6Z+a
EqD7JRhUV2ZQDnU=
UlWd0LffZzZeGY0BzkxroA==
sAbXk3SNlPOcRleKI+k=
HCpzqZKnJGDpf+qsxnOnvQ==
vGdG6Ezu8mctzfLnmX/FLDeiPS3M
tcctT/pPwrv7mdA0aw==
Tr6fUz4Ae0mrGA==
NxZtBUfk3aqxS1eKI+k=
TSUVzyy9hBs65j7xXSRVBx+M
fObBavCu4OEt/0pTr98J
2ap9Oy1p8MQP+EtTr98J
FL4Q0TXr1iHWjezVUdQtFT4=
kSFvf2KUliCDOWwacw==
ctqtSLZvqqr/xym6xnOnvQ==
8DqrrnN58fVC
fIrZCP4xwLt7CkGppluStw==
PFKUNZxcpLCtk6yjMus=
4CKOs2UMhs9P8EvLAXO1Hj8aNA==
0pEGOQOa0+SOV9AnYg==
qnDL6Mp+sL8W4CBtgbr5mmBu/BqoN1ksrg==
odQl1SvDIPk+MKbXqZfAxjdUZ68=
0Q8qhE+olFU=
WROEuZebCNvW80h5
h0y206dprMCvKLI4dv8ZEIted/zWuis=
XmZVAHxKyQ6rWboZFTdzGiDPLD3X
4V0534kw+m0tS3IudQ==
VW7HBe4GhtdGQpESaA==
6PRhiTetWC9f
TS+Gro2nN/ZgFm8=
wYLRnQutWC9f
xRpkKxw9tvyJJ05Tr98J
dnI90o62MwPdTqrWj5DJhqNg5QKkHW0krQ==
TZ7qiOquIOolB1JTr98J
an1eJRfZJSVLBEdTr98J
scbjg+SR3pwg8Cto
WJDNb9FuJbGBV5ZT10jM6yc=
3qWvw6zJe0mrGA==
RwJjfSnOxEqNKHY=
/369ev4qJSgTxSQafQ==
Arnyf3Qkl5NZ7zZv7Vqevw==
Vz+fGoISw0duIIM3dw==
xDaCJHZ4r0e+TZS78zhroA==
b74OqQq5JP86FDOrSfY=
bypvPjLvpu++Bewi1bwQRevIHhEkWSM=
gP/GfV98fUJL4ElTr98J
1qN0EnUJe0mrGA==
YhpjEWoZIeCOV9AnYg==
pyJykXi39H453yQgszKnTDqP
nPrtpRfi3D0G5kANY2VzZMk8ybWZA9vp
2/CILeCtWC9f
PUslsw+zEOze0hJg
U6mKVCtHTJc/AnqAPki2Iz6S
R+I7YVVpN+VI
LipwL4MgDmcYuONcSX2HpA==
Bx9LcVFpN+VI
LKiDNqxuZDJhGSpkHwInyRVC34jG
jyJreC7ZqDUG4hiV4ll+lfMoSqU=
qimAUsCWUV6jcK/e4BVH+CC7DSfO
Yd0uY+yRzNyOV9AnYg==
TGRP34usX2KRj5bVq7kA
HIZkGxBDNPOxf70v6J3HuA==
mUSrYyQ4puqAGok+wUjM6yc=
pzkdrg7Hrvirb9PEDAMcDDw=
take-solar.shop
Targets
-
-
Target
mary.bin
-
Size
56KB
-
MD5
e8bf77b057a93cafe70b86fdb9da6aed
-
SHA1
53f70d6a1f0a48522d90e1612bdf3c4b122fc504
-
SHA256
f53340a00d5248f81164bd5a1880698c4926cf62dc2fc5c93696f87780733b1a
-
SHA512
56d4f69822d9790caec4d53a3112038c7b0b518c013638ad7865dbd7a5e80d3d46b4da5d6170e888f5f3ae6c58231b2c3fbc7763f3107965eedb52b05d46461f
-
SSDEEP
768:k8s3JoK3x2Ncv+kIQZ5N9Fe6HmBouzruiRPPrk+FP:kB36I1vxIMW6HmBxuixPd
-
Blocklisted process makes network request
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-