Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
bcd6cf6116fe59919f3e2e2ca92e03267c3cda6e2802e330a036ef492146b75a
-
Size
1.7MB
-
Sample
221127-27d4aafc95
-
MD5
af2d7fb9fbf0fb5ccb3736a50595e1c2
-
SHA1
40a547cf32cf77b993963a7833a2b9981ef82acd
-
SHA256
bcd6cf6116fe59919f3e2e2ca92e03267c3cda6e2802e330a036ef492146b75a
-
SHA512
b06be7a07a521542da36a773c1b7f565938147928ed515182de1922bb1a60333a25118219eeeb7a113473dce028d115b15445d4087e11bae42b4d6736f5396ee
-
SSDEEP
24576:pRmJkcoQricOIQxiZY1iadvKmxTBNWyrAr7Kl3ysb375I8AS0fhGT48qlc:mJZoQrbTFZY1iaJ/Rro7Kl3ysK8A6X
Static task
static1
Behavioral task
behavioral1
Sample
bcd6cf6116fe59919f3e2e2ca92e03267c3cda6e2802e330a036ef492146b75a.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
bcd6cf6116fe59919f3e2e2ca92e03267c3cda6e2802e330a036ef492146b75a.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
darkcomet
Vecxed
clients.no-ip.org:1337
DC_MUTEX-YX2DBVE
-
gencode
hYAo19VcEYz5
-
install
false
-
offline_keylogger
true
-
password
Vicious1234
-
persistence
false
Targets
-
-
Target
bcd6cf6116fe59919f3e2e2ca92e03267c3cda6e2802e330a036ef492146b75a
-
Size
1.7MB
-
MD5
af2d7fb9fbf0fb5ccb3736a50595e1c2
-
SHA1
40a547cf32cf77b993963a7833a2b9981ef82acd
-
SHA256
bcd6cf6116fe59919f3e2e2ca92e03267c3cda6e2802e330a036ef492146b75a
-
SHA512
b06be7a07a521542da36a773c1b7f565938147928ed515182de1922bb1a60333a25118219eeeb7a113473dce028d115b15445d4087e11bae42b4d6736f5396ee
-
SSDEEP
24576:pRmJkcoQricOIQxiZY1iadvKmxTBNWyrAr7Kl3ysb375I8AS0fhGT48qlc:mJZoQrbTFZY1iaJ/Rro7Kl3ysK8A6X
-
Modifies visiblity of hidden/system files in Explorer
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-