Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
startup.dll.exe
-
Size
216KB
-
Sample
230518-rjcv7sbc71
-
MD5
33d60a6162d7c6c1f48f96c770ba8dc3
-
SHA1
6e9e1c3f7d570756e51a95d1add013a70340fd19
-
SHA256
cfbcaceb818ccb9659325848991f7825d682e790abecc15cf6418d3577f1f0c5
-
SHA512
ac9b80376166ceea1a612ccecab67ddb0b220003099efeaebcddae7bf96001118611b05263be32ca1cd581765fae920bd7ceae256ea7380cab39e967d5cf7c44
-
SSDEEP
3072:8wo8lMoohg9X4FmOpS3Td4pDwhDOXG9X7ZOqzm0mDrj0RtP5y:Flp9IFLpSd4pKOsX7ZOwmVDERS
Static task
static1
Behavioral task
behavioral1
Sample
startup.dll.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
startup.dll.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
smokeloader
sprg
Extracted
smokeloader
2022
http://hoh0aeghwugh2gie.com/
http://hie7doodohpae4na.com/
http://aek0aicifaloh1yo.com/
http://yic0oosaeiy7ahng.com/
http://wa5zu7sekai8xeih.com/
Extracted
vidar
3.9
da3b70a6d41764717ff479f0edd50071
https://steamcommunity.com/profiles/76561199263069598
https://t.me/cybehost
-
profile_id_v2
da3b70a6d41764717ff479f0edd50071
-
user_agent
Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.7 (like Gecko) (Debian)
Targets
-
-
Target
startup.dll.exe
-
Size
216KB
-
MD5
33d60a6162d7c6c1f48f96c770ba8dc3
-
SHA1
6e9e1c3f7d570756e51a95d1add013a70340fd19
-
SHA256
cfbcaceb818ccb9659325848991f7825d682e790abecc15cf6418d3577f1f0c5
-
SHA512
ac9b80376166ceea1a612ccecab67ddb0b220003099efeaebcddae7bf96001118611b05263be32ca1cd581765fae920bd7ceae256ea7380cab39e967d5cf7c44
-
SSDEEP
3072:8wo8lMoohg9X4FmOpS3Td4pDwhDOXG9X7ZOqzm0mDrj0RtP5y:Flp9IFLpSd4pKOsX7ZOwmVDERS
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-