Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
1phc1YJN.exe
-
Size
37KB
-
Sample
230615-vlcvrsaf28
-
MD5
fb0bdd758f8a9f405e6af2358da06ae1
-
SHA1
6c283ab5e49e6fe3a93a996f850a5639fc49e3f5
-
SHA256
9da4778fce03b654f62009b3d88958213f139b2f35fe1bed438100fae35bdfbf
-
SHA512
71d3bd1c621a93bc54f1104285da5bf8e59bc26c3055cf708f61070c1a80ee705c33efd4a05acf3d3a90a9d9fca0357c66894dcb5045ab38b27834ff56c06253
-
SSDEEP
384:NOpYoixJbl7OHg1WykrDPf7O8GsnRlrAF+rMRTyN/0L+EcoinblneHQM3epzXNsG:gpeR1NkrDPSlsRlrM+rMRa8NuPsCt
Behavioral task
behavioral1
Sample
1phc1YJN.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1phc1YJN.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
njrat
im523
TrupAshot
documents-elegant.at.ply.gg:54835
4a87b5397a2736773782f50e108b2da4
-
reg_key
4a87b5397a2736773782f50e108b2da4
-
splitter
|'|'|
Targets
-
-
Target
1phc1YJN.exe
-
Size
37KB
-
MD5
fb0bdd758f8a9f405e6af2358da06ae1
-
SHA1
6c283ab5e49e6fe3a93a996f850a5639fc49e3f5
-
SHA256
9da4778fce03b654f62009b3d88958213f139b2f35fe1bed438100fae35bdfbf
-
SHA512
71d3bd1c621a93bc54f1104285da5bf8e59bc26c3055cf708f61070c1a80ee705c33efd4a05acf3d3a90a9d9fca0357c66894dcb5045ab38b27834ff56c06253
-
SSDEEP
384:NOpYoixJbl7OHg1WykrDPf7O8GsnRlrAF+rMRTyN/0L+EcoinblneHQM3epzXNsG:gpeR1NkrDPSlsRlrM+rMRa8NuPsCt
Score10/10-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-