Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
25a6280b20b14dc747c700a1a91cb51b.exe
-
Size
537KB
-
Sample
230628-kepwmshg2x
-
MD5
25a6280b20b14dc747c700a1a91cb51b
-
SHA1
d6afd68cca616d505ac13532c008c328f225947d
-
SHA256
c81c9ba400d187e3f9ddbc3c9b31a5ac9ae2d102969a30d0896b19efd1981ceb
-
SHA512
06d636b0af2452865962004599dc3de9aa1a86c5ac058ba166dd27d68fcecde522a1d57f2faf8dae488d77686dcb7a0335ada5faa14fde82d7aa4d70c1831c8e
-
SSDEEP
12288:JPComBcpx1XTaASnOXo3aqhgXMQhbqCEPUwfqzbXKxySLJpcnZlmYH7J:4omB6RNhRqC3RHqDcnZ3l
Static task
static1
Behavioral task
behavioral1
Sample
25a6280b20b14dc747c700a1a91cb51b.exe
Resource
win7-20230621-en
Malware Config
Extracted
formbook
4.1
fgh2
jmplanejamento.com
fredinformatica.store
ekinarslan.com
dymovoi.site
fantasywagon.store
aigpthome.net
magadonian.club
artmartco.com
chk7.com
saltybeachtravels.com
ffdreakfas514.com
70555.top
studioeminc.com
ei863.com
ky55.xyz
xn--12c1cc1b5dd4n.com
aimedicarecoverage.com
varsasenindir.com
intuityx.com
mainfocusmediacompany.com
gamingord.xyz
votegailmajor.com
rule34.monster
acadiatesol.com
niagaraportthorold.com
fensterapp.com
kjszm.top
southfloridapaintings.com
dw85.xyz
realjourney.xyz
loto60.tube
idsc-co.com
kishorassociates.com
chickos.bio
teshack.world
ppzwb.top
archaeo-arts.com
33811.xyz
dollarbillstore.com
uncle-jesses-snack-bar.com
jeple.xyz
faravarsaz.com
tokempoocket.com
buygelpen.com
redluckycat.com
asdpolw.xyz
winecountrywinediva.com
xionqi88.com
rideorhike.win
switchon.shop
balantran.online
liza.world
clepcity.com
developmentcollective.shop
kzbjt.com
oconnerflatiron.com
borilee.store
character-try.xyz
cdbsoi.com
newenglandsign.company
f6g0a.com
vlokproducties.com
betalingenpayconiq.com
mykusadasi.com
theinfluencerlink.com
Targets
-
-
Target
25a6280b20b14dc747c700a1a91cb51b.exe
-
Size
537KB
-
MD5
25a6280b20b14dc747c700a1a91cb51b
-
SHA1
d6afd68cca616d505ac13532c008c328f225947d
-
SHA256
c81c9ba400d187e3f9ddbc3c9b31a5ac9ae2d102969a30d0896b19efd1981ceb
-
SHA512
06d636b0af2452865962004599dc3de9aa1a86c5ac058ba166dd27d68fcecde522a1d57f2faf8dae488d77686dcb7a0335ada5faa14fde82d7aa4d70c1831c8e
-
SSDEEP
12288:JPComBcpx1XTaASnOXo3aqhgXMQhbqCEPUwfqzbXKxySLJpcnZlmYH7J:4omB6RNhRqC3RHqDcnZ3l
-
Formbook payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-