Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Trojan-Ransom.Win32.Blocker.cnbl-836bde23efaee37bf62d5f53602031440ce58c9a99988b89edc6f50b6b3b2471
-
Size
346KB
-
Sample
221106-tpy2qschdr
-
MD5
1d763c73aae73235b4509e28870ac365
-
SHA1
75536427f7c3be699ad0f44b3ad87546b2532da3
-
SHA256
836bde23efaee37bf62d5f53602031440ce58c9a99988b89edc6f50b6b3b2471
-
SHA512
d7e64643aea6a28a1f775818ca1e25303aab8a27173a3cf0a6ed572476b3b6bb351c6fd279b83260831933b223915f5c6de3f80354f87d6e014cfe17e63bf627
-
SSDEEP
6144:8M3Ttl8q+AzLB9Ljr73Q0xOSluqJ9dJA6FQC6Gag3XsfR+qqnpwehl1jcjUm:nTtlJLfnj/gJsVFv6kqqlxjqUm
Static task
static1
Behavioral task
behavioral1
Sample
Kobotv1/Project1.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Kobotv1/Project1.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
Kobotv1/Project1.exe
-
Size
892KB
-
MD5
4f1b74dd94561adad98fd1d01d3377f5
-
SHA1
a096b8572ad7d5594718930ea1602362a5ac8b19
-
SHA256
001e3a5f374572aeb25eba1c8d63e598b632f656db6d206c77042e2bf1832180
-
SHA512
f42ebe083613f8920e84601f126e109373bb01377e7102a2edfa5024e6db8f46c52198fc729a7890ffcc673742e3b0e7e59c8eb28dd1f2fd7beae3f2f62c29c1
-
SSDEEP
24576:cOzOfWmQaxWRrWZOTx2SzT/lFnOREY9imH:c1mMOdbOREY91H
Score8/10-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-