Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
0x0007000000022e19-164.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
0x0007000000022e19-164.exe
Resource
win10v2004-20221111-en
General
-
Target
0x0007000000022e19-164.dat
-
Size
4.0MB
-
MD5
adc8831a1ca720028db3120e7325f537
-
SHA1
f2fd460cccfe764fbf623d0de8b9064d12c4235d
-
SHA256
3f8f82cc246266043b39729f99004dacc14ead06432e4c52198f967b0c84b7e9
-
SHA512
9e74b3ce63168e7e15ae57362f03641acfcbb86c2ef502a2e0834fff2dde8f7b6d16cdc860d1033d6279c3c3bc179168aedf0a8ca6e77233d953ee47c271216f
-
SSDEEP
49152:xANDFFPJu8fBsVE6ij+RNg+UKpBvtqB3m1RC3:x2zP88fBsnZTgOtqB3m1RC3
Malware Config
Extracted
loaderbot
http://mrmax4td.beget.tech/cmd.php
Signatures
-
LoaderBot executable 1 IoCs
resource yara_rule sample loaderbot -
Loaderbot family
Files
-
0x0007000000022e19-164.dat.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ