Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

(UFMA) RFQ...R7.scr

windows7-x64

10

(UFMA) RFQ...R7.scr

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    (UFMA) RFQ #180222BR24 & #160222BR7.gz

  • Size

    459KB

  • Sample

    230922-s62nhsah83

  • MD5

    73d54ad14a72dbea253f09bc93120db4

  • SHA1

    ec7f4e32bfa3666ce41c4bfaa8ca90b9d23cd3cd

  • SHA256

    15449626cb7fe15b8b669bf125b16c1113d106b9e465a306f444324449ec23f5

  • SHA512

    d1a81cd9971bb5f4247cb4eeb407669f52ee3d299e1949dc5debe5115f5be40e0c34cd9f499d33caa847e1d1e096e09ec1802871f0273ca139c86a74bdec90c7

  • SSDEEP

    12288:GSHNps1tv7eXRFyNx9KL+hsOW56hOjki56:7HNy1tDOL3Yx

Score
10/10
modiloaderpersistencetrojan

Malware Config

Targets

    • Target

      (UFMA) RFQ #180222BR24 & #160222BR7.scr

    • Size

      1.2MB

    • MD5

      3e890cd7def59cadc0be2850f79b717d

    • SHA1

      f9d0155561621c9d6feeff881b2f42502e4fb42b

    • SHA256

      7df63232b813270ba3333eeb76ae423da2a35fabf2bcf21a01269b9c8d29e8c5

    • SHA512

      14add30a809257feae32af8b95dcd43cd4e336761c7d80c0a8424b29e2f346658eb8a33cd4f6707582657f16ec1f2ff24b1abc8596b444191f0a7636cb39ffe4

    • SSDEEP

      12288:dN7i6PeBQ9p1nU+Ji+/F1u1mlNHbsgyAvBvvc+X2B+d4ELSQZBLLKbIt383739Da:d5i6lnUr+fuMpNDJ2UxtkRN0D9t1

    Score
    10/10
    modiloadertrojanpersistence

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks