Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Roblox Bedwars Best GUI - Linkvertise Downloader_vNS3-h1.exe
-
Size
10.8MB
-
Sample
230605-mnqweaga25
-
MD5
fc30f38c629fbafcfd1f4a4895814c46
-
SHA1
e6b298591f7034463f603ede1573c8a198938b7f
-
SHA256
40e1b53fb04746ac4a0561f5ab781291069b90232215afc36320263308a28ec9
-
SHA512
74aba9bd29a9d6200f5b35a15f66c6edb57b3a8cfa24b3c04f2a90224d64bcda7564047a5f88698107aaf5e18c6d22bc6d8f5f3fdfdda2bb86aeb800d90e37d2
-
SSDEEP
196608:w38JJEU16hTZl583S0LJu+mzfDkzXJKUNWGJ3k2ZoXOM1ugha:Z1MlCC0Ybzf4zZKUok5oXN8x
Static task
static1
Malware Config
Targets
-
-
Target
Roblox Bedwars Best GUI - Linkvertise Downloader_vNS3-h1.exe
-
Size
10.8MB
-
MD5
fc30f38c629fbafcfd1f4a4895814c46
-
SHA1
e6b298591f7034463f603ede1573c8a198938b7f
-
SHA256
40e1b53fb04746ac4a0561f5ab781291069b90232215afc36320263308a28ec9
-
SHA512
74aba9bd29a9d6200f5b35a15f66c6edb57b3a8cfa24b3c04f2a90224d64bcda7564047a5f88698107aaf5e18c6d22bc6d8f5f3fdfdda2bb86aeb800d90e37d2
-
SSDEEP
196608:w38JJEU16hTZl583S0LJu+mzfDkzXJKUNWGJ3k2ZoXOM1ugha:Z1MlCC0Ybzf4zZKUok5oXN8x
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Sets service image path in registry
-
Adds Run key to start application
-
Checks for any installed AV software in registry
-
Legitimate hosting services abused for malware hosting/C2
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory
-