Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
1e2b3c0589e8df18ada383c48347a28b.exe
-
Size
3.1MB
-
Sample
230331-fmz95age76
-
MD5
1e2b3c0589e8df18ada383c48347a28b
-
SHA1
d30189b257c6a303d41145c9f18709b9118c4eec
-
SHA256
c9fe71715c02aadcef31d9df6ad876f7d9ac9e747c0ec541139a2d22045a1b67
-
SHA512
d8e7b339dbcd20923442a6b6d77aea18b17f63207737a8c1efc556b7d57c634af2b325f0c1b658200f42ab4ac2f9a186284397e9c9e4f6cc20d65c15b39c3732
-
SSDEEP
49152:NAHDmz/PG7OIg7NMvWvnwvCoj85R1dvuxHxtx+6e+QCR0W4+RJHeEcs:NMKG7OIgpLnwwPFuRsUR0+RFZ
Static task
static1
Behavioral task
behavioral1
Sample
1e2b3c0589e8df18ada383c48347a28b.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1e2b3c0589e8df18ada383c48347a28b.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
raccoon
94c54520400750937a6f1bf6044f8667
http://185.181.10.208/
Targets
-
-
Target
1e2b3c0589e8df18ada383c48347a28b.exe
-
Size
3.1MB
-
MD5
1e2b3c0589e8df18ada383c48347a28b
-
SHA1
d30189b257c6a303d41145c9f18709b9118c4eec
-
SHA256
c9fe71715c02aadcef31d9df6ad876f7d9ac9e747c0ec541139a2d22045a1b67
-
SHA512
d8e7b339dbcd20923442a6b6d77aea18b17f63207737a8c1efc556b7d57c634af2b325f0c1b658200f42ab4ac2f9a186284397e9c9e4f6cc20d65c15b39c3732
-
SSDEEP
49152:NAHDmz/PG7OIg7NMvWvnwvCoj85R1dvuxHxtx+6e+QCR0W4+RJHeEcs:NMKG7OIgpLnwwPFuRsUR0+RFZ
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-