Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
SecuriteInfo.com.W32.MSIL_Agent.DZS.gen.Eldorado.30628.26370.exe
-
Size
823KB
-
Sample
221027-qkhbmsccfl
-
MD5
e98f7db67e567eee870d0bdbc078cf30
-
SHA1
cdbe9abe7426a5f237e70eba3009bd415f363b9f
-
SHA256
cd5cfb5118e9af25a488d5c360c67d934193fcbcd649bf2ff88afe5860da88b3
-
SHA512
eba5f3b8d1c168e3fd762156e40ac658e39bb2e480c4f461811f2d510fddf04a28e3326d19f5dad15be580303cbc383d5babefc2fa2b7feacef7ac5b01b33a84
-
SSDEEP
24576:NoWfjScOu165U4sgcb1VG+KP0Ce1Rl1U:NoWZOzb0lKP0Ce1Rlu
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W32.MSIL_Agent.DZS.gen.Eldorado.30628.26370.exe
Resource
win7-20220812-en
Malware Config
Extracted
formbook
4.1
ss63
heartgroupfurniture.com
petruskraftshop.net
bernesespirit.com
minulgul.com
canoncashier.com
britishsaschool.com
frau-kruppa.net
cj-zn.com
derdggyih5ctsc.kred
xvvbros.pics
unacucinadipasta.com
brandsalted.com
pledialinks.xyz
teslamoto.shop
doxycyclin.monster
nuflowalexandriava.com
eliteinfratech.com
laymember.net
bestprobiotics.online
diversifiedpower.international
autorenda.fun
ciseaux-a-bois.com
elsaltodelfraile.online
dikingte.cyou
gaosan123.com
gxgvdd.com
iz0maopis0o2p3.kred
mcc-xia55pjs.com
vnhanh.net
hey-hee.com
ahxinying.com
blanerussell.com
happytopia.net
pennburyfarm.shop
a5t3.cyou
wbhgxs027f.vip
mzzmj.com
grooming.asia
successful101.com
dagatructiephd.com
thinkphysiotherapy.com
thenewburaimohs.com
leedart.com
folsomappraisers.com
hindibizz.tech
cctrmo.com
blainrussell.com
pop-up-flat.com
xscnc.net
happykidsindonesia.com
nsber.store
mediqhealthcare.com
allinvest-swiss.com
chaokeke.com
littleyeoneo.com
yapek.xyz
9b505.app
dream.parts
vexpertsonline.com
bbpo11.com
candyclub7.world
fadesrus.net
poolsigncase.com
offplan.realestate
khetikissani.com
Targets
-
-
Target
SecuriteInfo.com.W32.MSIL_Agent.DZS.gen.Eldorado.30628.26370.exe
-
Size
823KB
-
MD5
e98f7db67e567eee870d0bdbc078cf30
-
SHA1
cdbe9abe7426a5f237e70eba3009bd415f363b9f
-
SHA256
cd5cfb5118e9af25a488d5c360c67d934193fcbcd649bf2ff88afe5860da88b3
-
SHA512
eba5f3b8d1c168e3fd762156e40ac658e39bb2e480c4f461811f2d510fddf04a28e3326d19f5dad15be580303cbc383d5babefc2fa2b7feacef7ac5b01b33a84
-
SSDEEP
24576:NoWfjScOu165U4sgcb1VG+KP0Ce1Rl1U:NoWZOzb0lKP0Ce1Rlu
-
Formbook payload
-
Suspicious use of SetThreadContext
-