Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    372daff38ea8b876b01803b474c7f687

  • Size

    906KB

  • Sample

    230522-blsfnsdc59

  • MD5

    372daff38ea8b876b01803b474c7f687

  • SHA1

    3e27eb6a6e9ec8f8be6609c85bb6b16376907fcf

  • SHA256

    625f5caa0e4422a01de12f875b7acf8c4edb699f36a7237c18bf3df7772a7e6c

  • SHA512

    9a27b0c2f7f3bd66f30f2bffbde4c44d82b541ade528c034ba1cd4f0facd89d472a98550834b8cf79b67a40afd50dd5eb02cd87dacc161c6a88b2b26a0eb87e6

  • SSDEEP

    24576:C0t8P0kqs+kTIvMRGfdx9YLXy+DB87qkC:IP01sWMRGfHuXy+Dx

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

gg04

Decoy

clothandsoulfabricllc.com

kx1336.com

4638.global

fixlaunchcredtunionmemb.online

indivexport.com

betuluzun.online

colossusboutique.com

hgcst.com

authorizer.online

hong-travel.com

globalwealthstrategiesco.com

fobberq.com

tribally.net

cook-a.com

todipjane.africa

membershipexams.africa

3dseal.online

abris-spb.ru

mkkkkk.net

chargecentral.store

Targets

    • Target

      372daff38ea8b876b01803b474c7f687

    • Size

      906KB

    • MD5

      372daff38ea8b876b01803b474c7f687

    • SHA1

      3e27eb6a6e9ec8f8be6609c85bb6b16376907fcf

    • SHA256

      625f5caa0e4422a01de12f875b7acf8c4edb699f36a7237c18bf3df7772a7e6c

    • SHA512

      9a27b0c2f7f3bd66f30f2bffbde4c44d82b541ade528c034ba1cd4f0facd89d472a98550834b8cf79b67a40afd50dd5eb02cd87dacc161c6a88b2b26a0eb87e6

    • SSDEEP

      24576:C0t8P0kqs+kTIvMRGfdx9YLXy+DB87qkC:IP01sWMRGfHuXy+Dx

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks