Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    25a6280b20b14dc747c700a1a91cb51b.exe

  • Size

    537KB

  • Sample

    230628-kepwmshg2x

  • MD5

    25a6280b20b14dc747c700a1a91cb51b

  • SHA1

    d6afd68cca616d505ac13532c008c328f225947d

  • SHA256

    c81c9ba400d187e3f9ddbc3c9b31a5ac9ae2d102969a30d0896b19efd1981ceb

  • SHA512

    06d636b0af2452865962004599dc3de9aa1a86c5ac058ba166dd27d68fcecde522a1d57f2faf8dae488d77686dcb7a0335ada5faa14fde82d7aa4d70c1831c8e

  • SSDEEP

    12288:JPComBcpx1XTaASnOXo3aqhgXMQhbqCEPUwfqzbXKxySLJpcnZlmYH7J:4omB6RNhRqC3RHqDcnZ3l

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

fgh2

Decoy

jmplanejamento.com

fredinformatica.store

ekinarslan.com

dymovoi.site

fantasywagon.store

aigpthome.net

magadonian.club

artmartco.com

chk7.com

saltybeachtravels.com

ffdreakfas514.com

70555.top

studioeminc.com

ei863.com

ky55.xyz

xn--12c1cc1b5dd4n.com

aimedicarecoverage.com

varsasenindir.com

intuityx.com

mainfocusmediacompany.com

Targets

    • Target

      25a6280b20b14dc747c700a1a91cb51b.exe

    • Size

      537KB

    • MD5

      25a6280b20b14dc747c700a1a91cb51b

    • SHA1

      d6afd68cca616d505ac13532c008c328f225947d

    • SHA256

      c81c9ba400d187e3f9ddbc3c9b31a5ac9ae2d102969a30d0896b19efd1981ceb

    • SHA512

      06d636b0af2452865962004599dc3de9aa1a86c5ac058ba166dd27d68fcecde522a1d57f2faf8dae488d77686dcb7a0335ada5faa14fde82d7aa4d70c1831c8e

    • SSDEEP

      12288:JPComBcpx1XTaASnOXo3aqhgXMQhbqCEPUwfqzbXKxySLJpcnZlmYH7J:4omB6RNhRqC3RHqDcnZ3l

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks