Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    scheduler.dll.exe

  • Size

    354KB

  • Sample

    230519-pw69gadh54

  • MD5

    ee003d5904c76e48228192c1ff786e47

  • SHA1

    91baeb13d806e934d9bfc91be5ea5b6eb0d75f3c

  • SHA256

    c9e9fc3a10a439f7e685f46ac95a28c291c8586f0302603f2337547331ae7c29

  • SHA512

    9a79891d82666ba1a7e3d1537ab6d0bf9c5514ec502cbcaaedabbfc6bd2ef545d94b6a67417e1b7311d2448c28a03851dc51c521ac70c273fb47c60656a79f0e

  • SSDEEP

    6144:h4SUjhtXAqTvkWqOs5PC+c5H9ByjuGHK2Tb+w/fw7FtbSJPB7A9K7:6XAqQWqp5C+c5HHyjO2nHHQFtbSZBMq

Malware Config

Extracted

Family

azorult

C2

http://kng4.shop/kng4/index.php

Targets

    • Target

      scheduler.dll.exe

    • Size

      354KB

    • MD5

      ee003d5904c76e48228192c1ff786e47

    • SHA1

      91baeb13d806e934d9bfc91be5ea5b6eb0d75f3c

    • SHA256

      c9e9fc3a10a439f7e685f46ac95a28c291c8586f0302603f2337547331ae7c29

    • SHA512

      9a79891d82666ba1a7e3d1537ab6d0bf9c5514ec502cbcaaedabbfc6bd2ef545d94b6a67417e1b7311d2448c28a03851dc51c521ac70c273fb47c60656a79f0e

    • SSDEEP

      6144:h4SUjhtXAqTvkWqOs5PC+c5H9ByjuGHK2Tb+w/fw7FtbSJPB7A9K7:6XAqQWqp5C+c5HHyjO2nHHQFtbSZBMq

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Loads dropped DLL

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks