Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Our request file PDF.exe

  • Size

    738KB

  • Sample

    221228-xvxyeaed51

  • MD5

    44a1abbd8fc39806ecce13416df1e150

  • SHA1

    050136ecb066c07cbad131cf565fa07c7f0be75a

  • SHA256

    c470e4b00af7989d546bcc74d51f93920ad6b17c097eb8fdece7f701d68ae052

  • SHA512

    ede306271ebbb5bd08b2f21479767aead0fe7e7f62f44b2c66fc88d71b7d1f9e6711350fb7d69cb2f170d1a8a15a3bd18364718e607a02c4b7da587146de7e1e

  • SSDEEP

    12288:k2iNa+PFC1XliH3mluQGhdYRhF82yyJMkOZ:k1wt1XliH3QCdYBJyWHO

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

he2a

Decoy

connectioncompass.store

zekicharge.com

dp77.shop

guninfo.guru

mamaeconomics.net

narcisme.coach

redtopassociates.com

ezezn.com

theoregondog.com

pagosmultired.online

emsculptcenterofne.com

meet-friends.online

pf326.com

wealthjigsaw.xyz

arsajib.com

kickassholdings.online

avaturre.biz

dtslogs.com

lb92.tech

pittalam.com

Targets

    • Target

      Our request file PDF.exe

    • Size

      738KB

    • MD5

      44a1abbd8fc39806ecce13416df1e150

    • SHA1

      050136ecb066c07cbad131cf565fa07c7f0be75a

    • SHA256

      c470e4b00af7989d546bcc74d51f93920ad6b17c097eb8fdece7f701d68ae052

    • SHA512

      ede306271ebbb5bd08b2f21479767aead0fe7e7f62f44b2c66fc88d71b7d1f9e6711350fb7d69cb2f170d1a8a15a3bd18364718e607a02c4b7da587146de7e1e

    • SSDEEP

      12288:k2iNa+PFC1XliH3mluQGhdYRhF82yyJMkOZ:k1wt1XliH3QCdYBJyWHO

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks