Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
file.exe
-
Size
1.4MB
-
Sample
221223-vjjwasca2t
-
MD5
afd26f223230ad20eb208dbaa0164e43
-
SHA1
9c92cde80d982dec72e5a2fb6553bc1cd89e8319
-
SHA256
fc0cb0682ccc37bdd72fab5106d45ebf7fb014b15004d65d627f6e2aed0750b4
-
SHA512
e0e284ffdd4ef7421a0c0ffb1cf6e2aa82707a861be84e98713a3efd385f1347d8c869709d941d19c0fb3df0d7e40aec1803fb14cc379cec98eeaf8e196aefce
-
SSDEEP
24576:cfR85lrIXtinFaRYaWZ22CJVf6GvhrRR44gaGVllYVYItTP4au+TK+Mx:cfS55IXluX4t2ID4au+2d
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
file.exe
-
Size
1.4MB
-
MD5
afd26f223230ad20eb208dbaa0164e43
-
SHA1
9c92cde80d982dec72e5a2fb6553bc1cd89e8319
-
SHA256
fc0cb0682ccc37bdd72fab5106d45ebf7fb014b15004d65d627f6e2aed0750b4
-
SHA512
e0e284ffdd4ef7421a0c0ffb1cf6e2aa82707a861be84e98713a3efd385f1347d8c869709d941d19c0fb3df0d7e40aec1803fb14cc379cec98eeaf8e196aefce
-
SSDEEP
24576:cfR85lrIXtinFaRYaWZ22CJVf6GvhrRR44gaGVllYVYItTP4au+TK+Mx:cfS55IXluX4t2ID4au+2d
-
Detect rhadamanthys stealer shellcode
-
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-