Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
ef0ceab01e813f995915d6c596bd663a469928024e9295b093388a4a7215bb1d
-
Size
694KB
-
Sample
221121-rpp3qadd32
-
MD5
c4523a20a3e46acad92e1cb38adc378b
-
SHA1
3f239f11ee2a8728cc65266111abbf64b1f8dc53
-
SHA256
ef0ceab01e813f995915d6c596bd663a469928024e9295b093388a4a7215bb1d
-
SHA512
4b0c6c0615b8c16583e21e7b68ec5c38e0f5ac1f480f3308d5734ce598836a2e27a80e2959458690ee9dcd7544ece9fad7e23b6c0356784524d6e0e439b4162b
-
SSDEEP
6144:rEa0dpkNz07AFqV57lNO4/mq3kl9SK5WO+Dg/Fb5aHDiTBfA+RhdUx9:Y57lNPmikl9SK5WAHkDiT5AshOf
Static task
static1
Malware Config
Extracted
formbook
54ut
1DeiXmzDLw+mW17NwLBXpXM=
Nouf/qArBV5GAPfIhxWPkDFrVQ==
9OCYganx4VaCX1EY/sUSfRDLx6s=
xh8rlilJ/SGckKI=
HGyA64YZyhUs3jvzno2F
yx7/XhxTuRiTcnLKrrOOXTrpW60=
ZYI6IbtcBFx+OpnLU0nXmw==
MhgenS1xYWYThQgS+A==
s0ada4bHHvtWWbYb
2/4IbaW+Ljsy6Ujzno2F
Z5WdKMj5YLgpH0ypdTEcLe2W/lf7j6Io
xXTmzNjzpvUMwTAHwYv2kw==
kcbnSAS0pkV2G1fXsFktVxiXmLTktXY=
PU0V5f0rnqjEhQgS+A==
Z8aNX4Sm/dbGhQgS+A==
s4bq4W4D4UJdYqqvU0nXmw==
a56Z6W0Asvwh3jzzno2F
Qmhm+fY3o6bEhQgS+A==
WIFCKZ/ZO+dCwTAHwYv2kw==
Nqjne5GxXbzY1f3Qp2rBkDFrVQ==
ay7FwPymWyoUA0koz4X1ehDLx6s=
X2o0F6xSKpbHwurLU0nXmw==
LFYJ2xarhGLbjvHcU0nXmw==
PmYYy+s3o6bEhQgS+A==
rwkKQFvxy2ZiaA==
3XLAIdpvIHb670l2Kqc=
SEcXPl3uyaH7yL8=
nLnFHxQxy2ZiaA==
7NSLjzvlluEAsgd8c2WWZSHl
glxZ3olyD3yr
T4Nv0GzC8Iy2
144yAAQ/7rnd1gbcU0nXmw==
f66mDKD54rYeyC4bzHTBkDFrVQ==
z8zuVQBKuBeKjeVeSsZPaiuoYa8Q
5BkEN0/qy2ZiaA==
Et5uXJROPkMej/HcU0nXmw==
boNTOsBnhavV4DcY93JFl20=
KoLKmKju0hwKt6rzno2F
8X4LUmuxhnvgrxwCvsj0wI5pQg==
NCXlK3yxGXvLNpIG
j66Me5rog6H7yL8=
amyG13MlGoDhqOLf1qP8kw==
X0ZQnCxpzS1UCl/Si1Kzhg==
lJ1rqfJ7IX6tcGt0aV2WZSHl
X0Q5m0GP/2nLNpIG
sh6ch5q8IPyTZoMY8rBXpXM=
2CgNdC9qBGOHeXh8iTfP7u2oYa8Q
9rYlLM5vG6+MO5ME
SvlsJoGP8mjLNpIG
qwJ1SHITt4wt5kpz5pr5lA==
fcSr9YbOupc+OFHFn12WZSHl
8FHEiZjje1jt5kl2Kqc=
nxNLtcdAoiaNN560U0nXmw==
6lbXv+BrFuHIhQgS+A==
47IJ2f0qmHQShQgS+A==
c85NKIjrpn9zLr+ddmTVo1bMtQjwlMteGw==
TwgwfvmZJQ==
JrJKFSds2K6UgbO0U0nXmw==
iYxlaAa2ofzvrr6oXs+WZSHl
rjbeubD0kH4l9El2Kqc=
gYyuLcEB6J7Daokv+N/nPjr7
38bCI5ig+E+2lJQQ77BXpXM=
XmuP6nmb/Yw7OlKveDNEjxDLx6s=
gJGl+cm3aDm4ZA==
yaoanx.space
Targets
-
-
Target
ef0ceab01e813f995915d6c596bd663a469928024e9295b093388a4a7215bb1d
-
Size
694KB
-
MD5
c4523a20a3e46acad92e1cb38adc378b
-
SHA1
3f239f11ee2a8728cc65266111abbf64b1f8dc53
-
SHA256
ef0ceab01e813f995915d6c596bd663a469928024e9295b093388a4a7215bb1d
-
SHA512
4b0c6c0615b8c16583e21e7b68ec5c38e0f5ac1f480f3308d5734ce598836a2e27a80e2959458690ee9dcd7544ece9fad7e23b6c0356784524d6e0e439b4162b
-
SSDEEP
6144:rEa0dpkNz07AFqV57lNO4/mq3kl9SK5WO+Dg/Fb5aHDiTBfA+RhdUx9:Y57lNPmikl9SK5WAHkDiT5AshOf
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-