Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    1.4MB

  • Sample

    221223-vjjwasca2t

  • MD5

    afd26f223230ad20eb208dbaa0164e43

  • SHA1

    9c92cde80d982dec72e5a2fb6553bc1cd89e8319

  • SHA256

    fc0cb0682ccc37bdd72fab5106d45ebf7fb014b15004d65d627f6e2aed0750b4

  • SHA512

    e0e284ffdd4ef7421a0c0ffb1cf6e2aa82707a861be84e98713a3efd385f1347d8c869709d941d19c0fb3df0d7e40aec1803fb14cc379cec98eeaf8e196aefce

  • SSDEEP

    24576:cfR85lrIXtinFaRYaWZ22CJVf6GvhrRR44gaGVllYVYItTP4au+TK+Mx:cfS55IXluX4t2ID4au+2d

Score
10/10
rhadamanthysbootkitevasionpersistencestealertrojan

Malware Config

Targets

    • Target

      file.exe

    • Size

      1.4MB

    • MD5

      afd26f223230ad20eb208dbaa0164e43

    • SHA1

      9c92cde80d982dec72e5a2fb6553bc1cd89e8319

    • SHA256

      fc0cb0682ccc37bdd72fab5106d45ebf7fb014b15004d65d627f6e2aed0750b4

    • SHA512

      e0e284ffdd4ef7421a0c0ffb1cf6e2aa82707a861be84e98713a3efd385f1347d8c869709d941d19c0fb3df0d7e40aec1803fb14cc379cec98eeaf8e196aefce

    • SSDEEP

      24576:cfR85lrIXtinFaRYaWZ22CJVf6GvhrRR44gaGVllYVYItTP4au+TK+Mx:cfS55IXluX4t2ID4au+2d

    Score
    10/10
    rhadamanthysbootkitevasionpersistencestealertrojan

    • Detect rhadamanthys stealer shellcode

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks whether UAC is enabled

      evasiontrojan

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks