Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
scheduler.dll.exe
-
Size
354KB
-
Sample
230519-pw69gadh54
-
MD5
ee003d5904c76e48228192c1ff786e47
-
SHA1
91baeb13d806e934d9bfc91be5ea5b6eb0d75f3c
-
SHA256
c9e9fc3a10a439f7e685f46ac95a28c291c8586f0302603f2337547331ae7c29
-
SHA512
9a79891d82666ba1a7e3d1537ab6d0bf9c5514ec502cbcaaedabbfc6bd2ef545d94b6a67417e1b7311d2448c28a03851dc51c521ac70c273fb47c60656a79f0e
-
SSDEEP
6144:h4SUjhtXAqTvkWqOs5PC+c5H9ByjuGHK2Tb+w/fw7FtbSJPB7A9K7:6XAqQWqp5C+c5HHyjO2nHHQFtbSZBMq
Static task
static1
Behavioral task
behavioral1
Sample
scheduler.dll.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
scheduler.dll.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
azorult
http://kng4.shop/kng4/index.php
Targets
-
-
Target
scheduler.dll.exe
-
Size
354KB
-
MD5
ee003d5904c76e48228192c1ff786e47
-
SHA1
91baeb13d806e934d9bfc91be5ea5b6eb0d75f3c
-
SHA256
c9e9fc3a10a439f7e685f46ac95a28c291c8586f0302603f2337547331ae7c29
-
SHA512
9a79891d82666ba1a7e3d1537ab6d0bf9c5514ec502cbcaaedabbfc6bd2ef545d94b6a67417e1b7311d2448c28a03851dc51c521ac70c273fb47c60656a79f0e
-
SSDEEP
6144:h4SUjhtXAqTvkWqOs5PC+c5H9ByjuGHK2Tb+w/fw7FtbSJPB7A9K7:6XAqQWqp5C+c5HHyjO2nHHQFtbSZBMq
Score10/10-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Checks QEMU agent file
Checks presence of QEMU agent, possibly to detect virtualization.
-
Loads dropped DLL
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-