Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
(ZEPP Transport GmbHPO07960)doc.exe
-
Size
227KB
-
Sample
221220-rk5mlsda3y
-
MD5
3c1f57b52d90b7597e57fcd4480f567a
-
SHA1
7bb6056875856d4e22a82a9d98edba7451253a13
-
SHA256
dc35769a749ae7caae46ba23c25c6cf8708a5e702b8dcf7d57fa365c8895d515
-
SHA512
1aa8ab514805df64bb7480a430a750d4744fdd659a5743b6205c9ea6a53645275ba67de3c2019590046fe44c67625ae7f210e2aaa139fb5495aef19d8036dac2
-
SSDEEP
6144:Q42xwMxES6pJRXDXg20zq/FNvkMA93m8h:NMMzTizIF9c93D
Static task
static1
Behavioral task
behavioral1
Sample
(ZEPP Transport GmbHPO07960)doc.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
(ZEPP Transport GmbHPO07960)doc.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
lokibot
https://efvsx.tk/PWS/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
(ZEPP Transport GmbHPO07960)doc.exe
-
Size
227KB
-
MD5
3c1f57b52d90b7597e57fcd4480f567a
-
SHA1
7bb6056875856d4e22a82a9d98edba7451253a13
-
SHA256
dc35769a749ae7caae46ba23c25c6cf8708a5e702b8dcf7d57fa365c8895d515
-
SHA512
1aa8ab514805df64bb7480a430a750d4744fdd659a5743b6205c9ea6a53645275ba67de3c2019590046fe44c67625ae7f210e2aaa139fb5495aef19d8036dac2
-
SSDEEP
6144:Q42xwMxES6pJRXDXg20zq/FNvkMA93m8h:NMMzTizIF9c93D
Score10/10-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-