Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
e29d8a7a6ef1c03ab236291d5d55a1c158fb8620042112bd3536f3fd677ea9f9
-
Size
90KB
-
Sample
221205-gv5egsgd7v
-
MD5
c70e44dfca36209f59e4ba3b9695f317
-
SHA1
d1d42708169094d2aa6b02270fdb93b334e50422
-
SHA256
e29d8a7a6ef1c03ab236291d5d55a1c158fb8620042112bd3536f3fd677ea9f9
-
SHA512
6cb54e379b8508ca7d0f2ce5a024b1e16fe948cebc2a1ccb209380f886992d4d1234f4d6bce9f5db6ac78936a682bc5e7644b2a40baca9e7f2076337e97b586d
-
SSDEEP
768:4+u501UWr+Mcpb8gYXuqAJ1Y+u4dB4puHChRT+WPq0nyiU3ktgXQ1TTGfL:4+u503xQqvH4r+3JirQ1E
Static task
static1
Behavioral task
behavioral1
Sample
e29d8a7a6ef1c03ab236291d5d55a1c158fb8620042112bd3536f3fd677ea9f9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e29d8a7a6ef1c03ab236291d5d55a1c158fb8620042112bd3536f3fd677ea9f9.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
griptoloji - Password:
741852
Targets
-
-
Target
e29d8a7a6ef1c03ab236291d5d55a1c158fb8620042112bd3536f3fd677ea9f9
-
Size
90KB
-
MD5
c70e44dfca36209f59e4ba3b9695f317
-
SHA1
d1d42708169094d2aa6b02270fdb93b334e50422
-
SHA256
e29d8a7a6ef1c03ab236291d5d55a1c158fb8620042112bd3536f3fd677ea9f9
-
SHA512
6cb54e379b8508ca7d0f2ce5a024b1e16fe948cebc2a1ccb209380f886992d4d1234f4d6bce9f5db6ac78936a682bc5e7644b2a40baca9e7f2076337e97b586d
-
SSDEEP
768:4+u501UWr+Mcpb8gYXuqAJ1Y+u4dB4puHChRT+WPq0nyiU3ktgXQ1TTGfL:4+u503xQqvH4r+3JirQ1E
Score10/10-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-