Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
94d9aab8b2afbd6321cdc1d71cf61e2ca6396d7374221335cc6a7ea7bbae3e04
-
Size
1.0MB
-
Sample
221201-zrjbysag95
-
MD5
ea152391202b4fcef52ec714ae5684bb
-
SHA1
0646192dd09e55ab2958fb753fc801d1ff293dcc
-
SHA256
94d9aab8b2afbd6321cdc1d71cf61e2ca6396d7374221335cc6a7ea7bbae3e04
-
SHA512
0940fb9e270d180d5b1b68b7db15425d20ba314a41da7042b07008312fa98ffbce21c78ca677b22eaea2e4b7b1b58fe9d38aa1483a93ef00cce1f5d9d3d83048
-
SSDEEP
24576:0cNJP38kXIxRkm0BCRLo50WD15X8ezAMPZWWPItL9wuWm7I1vq53b2:0cTPMkMRp5ORnXyG8tLPWm7aq53b2
Behavioral task
behavioral1
Sample
94d9aab8b2afbd6321cdc1d71cf61e2ca6396d7374221335cc6a7ea7bbae3e04.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
94d9aab8b2afbd6321cdc1d71cf61e2ca6396d7374221335cc6a7ea7bbae3e04.exe
Resource
win10v2004-20220901-en
Malware Config
Targets
-
-
Target
94d9aab8b2afbd6321cdc1d71cf61e2ca6396d7374221335cc6a7ea7bbae3e04
-
Size
1.0MB
-
MD5
ea152391202b4fcef52ec714ae5684bb
-
SHA1
0646192dd09e55ab2958fb753fc801d1ff293dcc
-
SHA256
94d9aab8b2afbd6321cdc1d71cf61e2ca6396d7374221335cc6a7ea7bbae3e04
-
SHA512
0940fb9e270d180d5b1b68b7db15425d20ba314a41da7042b07008312fa98ffbce21c78ca677b22eaea2e4b7b1b58fe9d38aa1483a93ef00cce1f5d9d3d83048
-
SSDEEP
24576:0cNJP38kXIxRkm0BCRLo50WD15X8ezAMPZWWPItL9wuWm7I1vq53b2:0cTPMkMRp5ORnXyG8tLPWm7aq53b2
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-