Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    ab4cb5d80de8ed6a1791f7cb189d6fb69b0fdc6a6298d6518446d1b3abfd3cdf

  • Size

    1.1MB

  • Sample

    221206-vtpvasgd49

  • MD5

    93a90c1bd243c9374f56bbc305019ba5

  • SHA1

    1ab2dcb3694583791b82d2503a0f2e5fe8774ef3

  • SHA256

    ab4cb5d80de8ed6a1791f7cb189d6fb69b0fdc6a6298d6518446d1b3abfd3cdf

  • SHA512

    4a5a33f738ea0463c0d64c5cf88ef20c7986ed78f56705f6e65a4c8687b4532e189aaf805a457244637ed05fb8d8e929b2885d5b3519be90fa347d03534e11b3

  • SSDEEP

    24576:VZxTFJ17kFTSNCdr+SzIAYqRavbkKlijox:VXTFfIRaCdaSdYsvjo

Malware Config

Targets

    • Target

      ab4cb5d80de8ed6a1791f7cb189d6fb69b0fdc6a6298d6518446d1b3abfd3cdf

    • Size

      1.1MB

    • MD5

      93a90c1bd243c9374f56bbc305019ba5

    • SHA1

      1ab2dcb3694583791b82d2503a0f2e5fe8774ef3

    • SHA256

      ab4cb5d80de8ed6a1791f7cb189d6fb69b0fdc6a6298d6518446d1b3abfd3cdf

    • SHA512

      4a5a33f738ea0463c0d64c5cf88ef20c7986ed78f56705f6e65a4c8687b4532e189aaf805a457244637ed05fb8d8e929b2885d5b3519be90fa347d03534e11b3

    • SSDEEP

      24576:VZxTFJ17kFTSNCdr+SzIAYqRavbkKlijox:VXTFfIRaCdaSdYsvjo

    • Ardamax

      A keylogger first seen in 2013.

    • Ardamax main executable

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks