Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

4af5374d05...75.exe

windows7-x64

10

4af5374d05...75.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4e0a57febe7c13d6f294ea34cbfc5cbf.bin

  • Size

    758KB

  • Sample

    231008-bwanlshc8s

  • MD5

    abaccec9dc5a1f17d6f93e966a4471a6

  • SHA1

    45d77c4f7f6f9825d7df316702420a7b34e9aaf6

  • SHA256

    708e685f0db9aab8e31d170d6e05f85aa906273fec441a2e4a696fd140f6f0bf

  • SHA512

    3dd792c067aadb62efc4f03516e8dfab09b2a88a9cf4165e2bd61400c84e447dc3a8dc05a919228657a19fec243daadcf5d89ce5cb703a506ca567fff61fbd0c

  • SSDEEP

    12288:RnsgIU63GiypsQluNP9j30TbG0H//xhX3YYgFfb7iPqg7zJh5AZ8B+e0iql7PN7M:Rd6WiypsQluNlb0+0H3xh4YgN7Vg7zDl

Score
10/10
formbookny02ratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ny02

Decoy

unirewards.online

giaoxuthanhgia.com

jennifersarrasin.online

hotelcampestrelafloresta.com

rwardsuprefortunerabbit.website

wanguardplacements.com

myfittedbedroomboutique.com

romariiregenerative.com

fashionhabesha.online

q778.top

embodiedtruthmethod.online

petgoodies.store

prismeventsandtours.com

onlinedelight.tech

segoviaresidencial.com

livewin.win

qhyhxs.com

kemprut.com

sanghahealing.net

forcewealthpower.com

Targets

    • Target

      4af5374d05140e1ebf05625397c061e7e6e6396597399880f903cdda22466875.bin

    • Size

      797KB

    • MD5

      4e0a57febe7c13d6f294ea34cbfc5cbf

    • SHA1

      f52a1d2cb7613c8fea67466dbbbce684541076a5

    • SHA256

      4af5374d05140e1ebf05625397c061e7e6e6396597399880f903cdda22466875

    • SHA512

      47a2824b4dea833948cde7ad378b5a30a58a7b7945695e556c96858a0c11484ccbed6256c3f7c63035b7de02da4d87619fd26de4913313143d617dac651085a7

    • SSDEEP

      24576:0uLklAVXeIpaVidw9koilGCKfwd2WQkRv0yw1FuZdu:NLvV+19pilHK4dj9R8Hu+

    Score
    10/10
    formbookny02ratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks