Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
1Static
static
1Payload/Ze...roller
macos-10.15-amd64
1Payload/Ze...bImage
macos-10.15-amd64
1Payload/Ze.../Zebra
macos-10.15-amd64
1Payload/Ze...s.html
windows7-x64
1Payload/Ze...s.html
windows10-2004-x64
1Payload/Ze...min.js
windows7-x64
1Payload/Ze...min.js
windows10-2004-x64
1Payload/Ze...n.html
windows7-x64
1Payload/Ze...n.html
windows10-2004-x64
1Analysis
-
max time kernel
131s -
max time network
134s -
platform
macos_amd64 -
resource
macos-20220504-en -
resource tags
arch:amd64arch:i386image:macos-20220504-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
07/03/2023, 00:02
Static task
static1
Behavioral task
behavioral1
Sample
Payload/Zebra.app/Frameworks/LNPopupController.framework/LNPopupController
Resource
macos-20220504-en
Behavioral task
behavioral2
Sample
Payload/Zebra.app/Frameworks/SDWebImage.framework/SDWebImage
Resource
macos-20220504-en
Behavioral task
behavioral3
Sample
Payload/Zebra.app/Zebra
Resource
macos-20220504-en
Behavioral task
behavioral4
Sample
Payload/Zebra.app/installed_files.html
Resource
win7-20230220-en
Behavioral task
behavioral5
Sample
Payload/Zebra.app/installed_files.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
Payload/Zebra.app/ios7.min.js
Resource
win7-20230220-en
Behavioral task
behavioral7
Sample
Payload/Zebra.app/ios7.min.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral8
Sample
Payload/Zebra.app/package_depiction.html
Resource
win7-20230220-en
Behavioral task
behavioral9
Sample
Payload/Zebra.app/package_depiction.html
Resource
win10v2004-20230221-en
General
-
Target
Payload/Zebra.app/Frameworks/SDWebImage.framework/SDWebImage
-
Size
6.0MB
-
MD5
9aa7b046bcd1b76cca8734894072a5e1
-
SHA1
d79f79526bc922cb11891a6867e624fc50b8441f
-
SHA256
9ab0d8241bdee62796f4be75b14445dc9b6b681a963f1f0c534bdd57d35913d0
-
SHA512
2874ea3bec41b6443c4e952fb053d5e7365178db86e8c4b26ad57223f2e13fd7e292d710751ba96aa17421da578b7588be8ca316063b88174249abc6e42df450
-
SSDEEP
98304:jjYk6dEcUEumJNbEp6/o7l+VGoGPEgiaaKeWW9lDnI/:jT/OHZEp6/o7l+VG+xfI/
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/Payload/Zebra.app/Frameworks/SDWebImage.framework/SDWebImage\""1⤵PID:515
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Payload/Zebra.app/Frameworks/SDWebImage.framework/SDWebImage\""1⤵PID:515
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Payload/Zebra.app/Frameworks/SDWebImage.framework/SDWebImage\""1⤵PID:515
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/Payload/Zebra.app/Frameworks/SDWebImage.framework/SDWebImage1⤵PID:515
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/Payload/Zebra.app/Frameworks/SDWebImage.framework/SDWebImage1⤵PID:515
-
/bin/zsh/bin/zsh -c /Users/run/Payload/Zebra.app/Frameworks/SDWebImage.framework/SDWebImage2⤵PID:516
-
-
/bin/zsh/bin/zsh -c /Users/run/Payload/Zebra.app/Frameworks/SDWebImage.framework/SDWebImage2⤵PID:516
-
-
/Users/run/Payload/Zebra.app/Frameworks/SDWebImage.framework/SDWebImage/Users/run/Payload/Zebra.app/Frameworks/SDWebImage.framework/SDWebImage2⤵PID:516
-
-
/Users/run/Payload/Zebra.app/Frameworks/SDWebImage.framework/SDWebImage/Users/run/Payload/Zebra.app/Frameworks/SDWebImage.framework/SDWebImage2⤵PID:516
-