Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
STUB.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
STUB.exe
Resource
win10v2004-20231215-en
General
-
Target
STUB.EXE
-
Size
3.8MB
-
MD5
08b8d6d55fa0ab4034e2080270e83fdb
-
SHA1
4fba6fa6251f41e381588335e7b73c77765149f9
-
SHA256
f0c2e55ec391d428f5f79b270bc770f5c684414becd8d2c7f0c8fb78462b47bb
-
SHA512
83ff113311596c16c8f6192ce7b1e03125327f225d9734074508ea9a4925e897ea6b5afbb648434082bf5d058ed442bb5993f057be407282ec20e5e6613a2beb
-
SSDEEP
98304:d77Pmq33rE/JDLPWZADUGer7B6iY74M/DmlwXVZ4FB:5+R/eZADUXR
Malware Config
Extracted
bitrat
1.38
Cluluvsu-34807.portmap.host:34807
-
communication_password
e10adc3949ba59abbe56e057f20f883e
-
install_dir
sdudir
-
install_file
sudir
-
tor_process
tor
Signatures
-
Bitrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource STUB.EXE
Files
-
STUB.EXE.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 687KB - Virtual size: 686KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 72KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 146KB - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ