Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
NEW ORDER IMP.xls
-
Size
1.3MB
-
Sample
230320-k1zyqscf63
-
MD5
beff0a43acfbdadee4b778952a27cc28
-
SHA1
a4598522d27ec5027c3e9b29690c8e6392e5fe1a
-
SHA256
dc54de15c8615d5523ba7ef2debf9a93ff76661f5c2f6e6d9f5cb594e753ee3e
-
SHA512
8d376e2ae51ea9652ed27ed9b88486949a909dd23f96ecaa28b4c54e1a664cd648629afc326b4c8e18b6195311ddc1e5b832216de9be6504a1c53f9cb45bd9e6
-
SSDEEP
24576:5LKKWQmmav30xl+MXUl3bVt3bVE+MXUu9O3bVf+MXUu9t3bVr1FYVCnSGmV:5LKvQmmQ30b+MXe3bVt3bVE+MXV9O3bc
Static task
static1
Behavioral task
behavioral1
Sample
NEW ORDER IMP.xls
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
NEW ORDER IMP.xls
Resource
win10v2004-20230220-en
Malware Config
Extracted
lokibot
http://185.246.220.60/chang/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
NEW ORDER IMP.xls
-
Size
1.3MB
-
MD5
beff0a43acfbdadee4b778952a27cc28
-
SHA1
a4598522d27ec5027c3e9b29690c8e6392e5fe1a
-
SHA256
dc54de15c8615d5523ba7ef2debf9a93ff76661f5c2f6e6d9f5cb594e753ee3e
-
SHA512
8d376e2ae51ea9652ed27ed9b88486949a909dd23f96ecaa28b4c54e1a664cd648629afc326b4c8e18b6195311ddc1e5b832216de9be6504a1c53f9cb45bd9e6
-
SSDEEP
24576:5LKKWQmmav30xl+MXUl3bVt3bVE+MXUu9O3bVf+MXUu9t3bVr1FYVCnSGmV:5LKvQmmQ30b+MXe3bVt3bVE+MXV9O3bc
Score10/10-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-