Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
file.exe
-
Size
5.9MB
-
Sample
231105-w9f3rsca82
-
MD5
d9f37da7068944e3f6fb3701ed5a23f4
-
SHA1
19a934a02dd0a73ff7b5ef2bed4d00199bfd77c4
-
SHA256
feba231aaebe46091330ed870baf583ad46b203e99a1914969bdd6733e87266a
-
SHA512
207002a444150ef45813350a14f245943a098c6a44a95d27b6c946346436bc9f8917005ab1c9268777ca18e57f52f6cee00febf1338d2f4a1a587237a3a3ffbe
-
SSDEEP
98304:nf8ZLx8SJ3qePnLA9RIdsRiqZOQ00w6akHDYX3qvvZPI5pmK93SjYnos25IAi0kq:f8ZLx8CxPLQVR91zHpq34xwS+3KIo0U
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20231023-en
Malware Config
Extracted
risepro
194.169.175.123
Targets
-
-
Target
file.exe
-
Size
5.9MB
-
MD5
d9f37da7068944e3f6fb3701ed5a23f4
-
SHA1
19a934a02dd0a73ff7b5ef2bed4d00199bfd77c4
-
SHA256
feba231aaebe46091330ed870baf583ad46b203e99a1914969bdd6733e87266a
-
SHA512
207002a444150ef45813350a14f245943a098c6a44a95d27b6c946346436bc9f8917005ab1c9268777ca18e57f52f6cee00febf1338d2f4a1a587237a3a3ffbe
-
SSDEEP
98304:nf8ZLx8SJ3qePnLA9RIdsRiqZOQ00w6akHDYX3qvvZPI5pmK93SjYnos25IAi0kq:f8ZLx8CxPLQVR91zHpq34xwS+3KIo0U
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-