Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
9f7dfb962e2bf51b8635de5abf80bede395c54abdd19ce0e7caa2343667fefe9.zip
-
Size
6.5MB
-
Sample
230308-mlpkkafe93
-
MD5
9cde2cb56b259f9e907bcb21d8448c1d
-
SHA1
9b8da579e0779c7f858f65c54e1864b91db3c229
-
SHA256
2a54e1cba81d377e368448e8c69c1d088d6c3aa27b6bc5b9228c02a118e21f36
-
SHA512
32e51da8ffed7206ee00372738cad6ba05d54c92704aa78db1435ed62bb9d1b4e9f9d532987993972cd404f42619d5cc3ffb577fc073f35db314964b5d2c9bd8
-
SSDEEP
196608:uohcHjPr0O0hnYEc8mVEZg/kfDqbF0hY9A6JcNW:uohcDT0O01YEouDfYe4JSW
Static task
static1
Behavioral task
behavioral1
Sample
9f7dfb962e2bf51b8635de5abf80bede395c54abdd19ce0e7caa2343667fefe9.exe
Resource
win7-20230220-en
Malware Config
Extracted
loaderbot
http://92.204.173.86/cmd.php
Targets
-
-
Target
9f7dfb962e2bf51b8635de5abf80bede395c54abdd19ce0e7caa2343667fefe9.exe
-
Size
6.5MB
-
MD5
310ad4f57eff4a82c55e34a2723dd283
-
SHA1
57aec7958f04644ce076e1c78df730cb698e31ad
-
SHA256
9f7dfb962e2bf51b8635de5abf80bede395c54abdd19ce0e7caa2343667fefe9
-
SHA512
66404b6d1c04cbea7b23321339aa99b0988f6a4a61d64b313e64ccb2fadc362b094a90c98e184927bd97f9993897038bc9fe4c3c07afdd27d632aefe3b5d3877
-
SSDEEP
196608:ly3FwVssRJTy/xr85Z3MBRDnglLOIeyqZ5:lGFWsyu8b96
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
LoaderBot executable
-
XMRig Miner payload
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-