Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe
-
Size
81KB
-
Sample
221201-wl91yahc2s
-
MD5
ab1094bc750e9ee2604b4c69d4b27099
-
SHA1
2093c3b4232929ee355cef027f02b8fa56475c17
-
SHA256
c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe
-
SHA512
4929580a82a8d6b3c11d9578788291953cc196b856c29f2069d33b9ab5bf96b4111701cfb41c3e2a7fdc5b32f847cfb84b0f23e5ba457f0cb1bb835ca0682481
-
SSDEEP
1536:6aH1w5TZVN7ciGKTFmLq6d7b/PjuYgFIPV6KFTf3iimaHUavfvV:V1qrd3TFmGo/LuYGIdnfd2un
Static task
static1
Behavioral task
behavioral1
Sample
c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe.exe
Resource
win7-20220812-en
Malware Config
Extracted
pony
http://dreststat.info:2346/pony/mac.php
http://dertystat.info:2346/pony/mac.php
-
payload_url
http://dertystat.info:2346/pony/view/kos.exe
Targets
-
-
Target
c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe
-
Size
81KB
-
MD5
ab1094bc750e9ee2604b4c69d4b27099
-
SHA1
2093c3b4232929ee355cef027f02b8fa56475c17
-
SHA256
c5f1dd526e09e635b8b7cbe7658358e042ddf092bdda814a3328a42f47e49cbe
-
SHA512
4929580a82a8d6b3c11d9578788291953cc196b856c29f2069d33b9ab5bf96b4111701cfb41c3e2a7fdc5b32f847cfb84b0f23e5ba457f0cb1bb835ca0682481
-
SSDEEP
1536:6aH1w5TZVN7ciGKTFmLq6d7b/PjuYgFIPV6KFTf3iimaHUavfvV:V1qrd3TFmGo/LuYGIdnfd2un
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-