Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
NEAS.36dec1751c676cafb65f3e50071a3860.exe
-
Size
90KB
-
Sample
231022-vtyr7sed86
-
MD5
36dec1751c676cafb65f3e50071a3860
-
SHA1
208d40910dfee672140b0e274a9884831168eb95
-
SHA256
6c1d1a4a4df315cb4c27041e8291479e3e75775d6f635959843518d612aaba0c
-
SHA512
8e87f271c047e3cb4e56590a1a0ae1f60f72f6c9c40a72a3a7efd79ccd11f1a95332bc981224d322814caa5ecd35a9c66dfb56a7a73e88a8ae6bc0e89d53abe2
-
SSDEEP
1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDL:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y
Behavioral task
behavioral1
Sample
NEAS.36dec1751c676cafb65f3e50071a3860.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.36dec1751c676cafb65f3e50071a3860.exe
Resource
win10v2004-20231020-en
Malware Config
Targets
-
-
Target
NEAS.36dec1751c676cafb65f3e50071a3860.exe
-
Size
90KB
-
MD5
36dec1751c676cafb65f3e50071a3860
-
SHA1
208d40910dfee672140b0e274a9884831168eb95
-
SHA256
6c1d1a4a4df315cb4c27041e8291479e3e75775d6f635959843518d612aaba0c
-
SHA512
8e87f271c047e3cb4e56590a1a0ae1f60f72f6c9c40a72a3a7efd79ccd11f1a95332bc981224d322814caa5ecd35a9c66dfb56a7a73e88a8ae6bc0e89d53abe2
-
SSDEEP
1536:UiYwjQt6QJvzZsgDIWzm/xsXfv+hYhyQQyV5uv4JBrB7w5VRGulTG1ZCL8nj1oDL:0wjZQJvzZsgsW6/Afv+hYfQIm4/rdE3Y
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-