Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3afkconsoleclient.exe
windows7-x64
7afkconsoleclient.exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDIR/app-64.7z
windows7-x64
3$PLUGINSDIR/app-64.7z
windows10-2004-x64
7LICENSE.electron.txt
windows7-x64
1LICENSE.electron.txt
windows10-2004-x64
1chrome_100...nt.pak
windows7-x64
3chrome_100...nt.pak
windows10-2004-x64
3chrome_200...nt.pak
windows7-x64
3chrome_200...nt.pak
windows10-2004-x64
3icudtl.dat
windows7-x64
3icudtl.dat
windows10-2004-x64
3locales/af.pak
windows7-x64
3locales/af.pak
windows10-2004-x64
3locales/am.pak
windows7-x64
3locales/am.pak
windows10-2004-x64
3locales/ar.pak
windows7-x64
3locales/ar.pak
windows10-2004-x64
3locales/bg.pak
windows7-x64
3locales/bg.pak
windows10-2004-x64
3locales/bn.pak
windows7-x64
3locales/bn.pak
windows10-2004-x64
3resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1General
-
Target
afkconsoleclient.exe
-
Size
88.1MB
-
Sample
240219-ythyjacg43
-
MD5
2bd08d8d42f3c2789b91bc4b82d87ff9
-
SHA1
6c49972d4e16aa7c663fda5b7750e5dfdc2ae977
-
SHA256
80a2f9e557e81028d751037e5d27bb90cd7b822bc0e6a6e4201287074d8fec08
-
SHA512
3666a81ca5a66e809d01d15a210585fdc18c73074faa8064d2ce677012f069bdc7d0335e7ae757c7a33c74b52f1597c42407f201173da03c594f697dfa2173f1
-
SSDEEP
1572864:BUukF5V0Acb7RzHb9ppW1eo9qXT8GvwtGeTP34o41T8YmgFwU:Bw90AkBHRMB9qQGotNTPXi/F3
Static task
static1
Behavioral task
behavioral1
Sample
afkconsoleclient.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
afkconsoleclient.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/app-64.7z
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/app-64.7z
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
LICENSE.electron.txt
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
LICENSE.electron.txt
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
chrome_100_percent.pak
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
chrome_100_percent.pak
Resource
win10v2004-20231222-en
Behavioral task
behavioral17
Sample
chrome_200_percent.pak
Resource
win7-20240215-en
Behavioral task
behavioral18
Sample
chrome_200_percent.pak
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
icudtl.dat
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
icudtl.dat
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
locales/af.pak
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
locales/af.pak
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
locales/am.pak
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
locales/am.pak
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
locales/ar.pak
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
locales/ar.pak
Resource
win10v2004-20231222-en
Behavioral task
behavioral27
Sample
locales/bg.pak
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
locales/bg.pak
Resource
win10v2004-20231222-en
Behavioral task
behavioral29
Sample
locales/bn.pak
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
locales/bn.pak
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
resources/elevate.exe
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
resources/elevate.exe
Resource
win10v2004-20231215-en
Malware Config
Targets
-
-
Target
afkconsoleclient.exe
-
Size
88.1MB
-
MD5
2bd08d8d42f3c2789b91bc4b82d87ff9
-
SHA1
6c49972d4e16aa7c663fda5b7750e5dfdc2ae977
-
SHA256
80a2f9e557e81028d751037e5d27bb90cd7b822bc0e6a6e4201287074d8fec08
-
SHA512
3666a81ca5a66e809d01d15a210585fdc18c73074faa8064d2ce677012f069bdc7d0335e7ae757c7a33c74b52f1597c42407f201173da03c594f697dfa2173f1
-
SSDEEP
1572864:BUukF5V0Acb7RzHb9ppW1eo9qXT8GvwtGeTP34o41T8YmgFwU:Bw90AkBHRMB9qQGotNTPXi/F3
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
-
-
Target
$PLUGINSDIR/StdUtils.dll
-
Size
100KB
-
MD5
c6a6e03f77c313b267498515488c5740
-
SHA1
3d49fc2784b9450962ed6b82b46e9c3c957d7c15
-
SHA256
b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
-
SHA512
9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
-
SSDEEP
3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score3/10 -
-
-
Target
$PLUGINSDIR/System.dll
-
Size
12KB
-
MD5
0d7ad4f45dc6f5aa87f606d0331c6901
-
SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457
-
SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
-
SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
SSDEEP
192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score3/10 -
-
-
Target
$PLUGINSDIR/UAC.dll
-
Size
14KB
-
MD5
adb29e6b186daa765dc750128649b63d
-
SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9
-
SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
-
SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
-
SSDEEP
192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
Score3/10 -
-
-
Target
$PLUGINSDIR/WinShell.dll
-
Size
3KB
-
MD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56
-
SHA1
0b9519763be6625bd5abce175dcc59c96d100d4c
-
SHA256
9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
-
SHA512
7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
Score3/10 -
-
-
Target
$PLUGINSDIR/app-64.7z
-
Size
87.2MB
-
MD5
4a37499f673e65a1abf983f32538bf37
-
SHA1
2aba5488d09519371fc2274b75071b1c05d05d07
-
SHA256
26787d348a2a3d404de3a05b33831386e67324b8ffa1ba9a3024641621a37771
-
SHA512
ac78894ad76b25d685dc2bef312f74c0e656eaec89f3019eede858722b6facbe555ad8a8b9a954671d8ccf9fb77e205f7bc52646fe9328c64f5092d0abfcf133
-
SSDEEP
1572864:gukF5V0Acb7RzHb9ppW1eo9qXT8GvwtGeTP34o41T8YmgFwQ:U90AkBHRMB9qQGotNTPXi/F/
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
-
-
Target
LICENSE.electron.txt
-
Size
1KB
-
MD5
4d42118d35941e0f664dddbd83f633c5
-
SHA1
2b21ec5f20fe961d15f2b58efb1368e66d202e5c
-
SHA256
5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
-
SHA512
3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
Score1/10 -
-
-
Target
chrome_100_percent.pak
-
Size
126KB
-
MD5
8626e1d68e87f86c5b4dabdf66591913
-
SHA1
4cd7b0ac0d3f72587708064a7b0a3beca3f7b81c
-
SHA256
2caa1da9b6a6e87bdb673977fee5dd771591a1b6ed5d3c5f14b024130a5d1a59
-
SHA512
03bcd8562482009060f249d6a0dd7382fc94d669a2094dec08e8d119be51bef2c3b7b484bb5b7f805ae98e372dab9383a2c11a63ab0f5644146556b1bb9a4c99
-
SSDEEP
3072:AEKzwqCT4weSxQCS/qGTL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:AEKzwt4hC4/rK18Gb0OV8ld0GecQ3f2
Score3/10 -
-
-
Target
chrome_200_percent.pak
-
Size
175KB
-
MD5
48515d600258d60019c6b9c6421f79f6
-
SHA1
0ef0b44641d38327a360aa6954b3b6e5aab2af16
-
SHA256
07bee34e189fe9a8789aed78ea59ad41414b6e611e7d74da62f8e6ca36af01ce
-
SHA512
b7266bc8abc55bd389f594dac0c0641ecf07703f35d769b87e731b5fdf4353316d44f3782a4329b3f0e260dead6b114426ddb1b0fb8cd4a51e0b90635f1191d9
-
SSDEEP
3072:rDQYaEQN6AJPrSxQCS/qGTafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/r4:rDQYaNN68rC4/Ygx5GMRejnbdZnVE6YR
Score3/10 -
-
-
Target
icudtl.dat
-
Size
10.1MB
-
MD5
2c367970ac87a9275eeec5629bb6fc3d
-
SHA1
399324d1aeee5e74747a6873501a1ee5aac005ee
-
SHA256
17d57b17d12dc5cfbf06413d68a06f45ccf245f4abdf5429f30256977c4ed6de
-
SHA512
f788a0d35f9e4bebe641ee67fff14968b62891f52d05bf638cd2c845df87f2e107c42a32bbe62f389f05e5673fe55cbdb85258571e698325400705cd7b16db01
-
SSDEEP
98304:TfPBQYOo+ddlymYf2LfPQCvliXUxiG9Ha93Whla6ZENSs285:TfPBhORjYAHliXUxiG9Ha93Whla6ZEV7
Score3/10 -
-
-
Target
locales/af.pak
-
Size
353KB
-
MD5
464e5eeaba5eff8bc93995ba2cb2d73f
-
SHA1
3b216e0c5246c874ad0ad7d3e1636384dad2255d
-
SHA256
0ad547bb1dc57907adeb02e1be3017cce78f6e60b8b39395fe0e8b62285797a1
-
SHA512
726d6c41a9dbf1f5f2eff5b503ab68d879b088b801832c13fba7eb853302b16118cacda4748a4144af0f396074449245a42b2fe240429b1afcb7197fa0cb6d41
-
SSDEEP
6144:j54QCpN9/WiHIR9a5D4+kQMGSB+jC6kAw1TUKKpg3b9xIsVxSt2y5qP3ux5tPwDV:F9CpN9OiHIRX+HMT+jC6kAw1TYpg3b9P
Score3/10 -
-
-
Target
locales/am.pak
-
Size
569KB
-
MD5
2c933f084d960f8094e24bee73fa826c
-
SHA1
91dfddc2cff764275872149d454a8397a1a20ab1
-
SHA256
fa1e44215bd5acc7342c431a3b1fddb6e8b6b02220b4599167f7d77a29f54450
-
SHA512
3c9ecfb0407de2aa6585f4865ad54eeb2ec6519c9d346e2d33ed0e30be6cc3ebfed676a08637d42c2ca8fa6cfefb4091feb0c922ff71f09a2b89cdd488789774
-
SSDEEP
12288:QqhqEuPxT8xZTtWosuF9Q5m9yAAVzfukCQox30jH8+I:Zh8T8xTWoZF9Q5m9yAAVzXCQ0
Score3/10 -
-
-
Target
locales/ar.pak
-
Size
624KB
-
MD5
6352905a290802a05dd3a64d22216f6e
-
SHA1
11adb10f0678079c8f73779bb039e12329bcaac7
-
SHA256
00861d9fa5763cc5c3152edb4a5c956c6bc4f56311ce2ed9e6b496181624ab5e
-
SHA512
0b0dbad8201ebd1a7dc2cfb11325c509efbcced3ac3d337915cf2972defe2304ea9f8af91d9362cb51333459900a80b714e7302a6483ad58fd64404f8410b6ea
-
SSDEEP
12288:Z/yZHOg8tqI45/XvYUtOkjbkqBJ51NbW+eTtvZEMgSENOM:4ZHOgUYRF75S+3
Score3/10 -
-
-
Target
locales/bg.pak
-
Size
652KB
-
MD5
38bcabb6a0072b3a5f8b86b693eb545d
-
SHA1
d36c8549fe0f69d05ffdaffa427d3ddf68dd6d89
-
SHA256
898621731ac3471a41f8b3a7bf52e7f776e8928652b37154bc7c1299f1fd92e1
-
SHA512
002adbdc17b6013becc4909daf2febb74ce88733c78e968938b792a52c9c5a62834617f606e4cb3774ae2dad9758d2b8678d7764bb6dcfe468881f1107db13ef
-
SSDEEP
12288:MMq8w2kMLlYrdAs1aQUx41aVVwslMLOmFOMw35uKN31tfbDMxbV2Jfu64Kjz5fS+:MMqckulYrdAs1aQUmBsmRw35uK7Jgxho
Score3/10 -
-
-
Target
locales/bn.pak
-
Size
838KB
-
MD5
9340520696e7cb3c2495a78893e50add
-
SHA1
eed5aeef46131e4c70cd578177c527b656d08586
-
SHA256
1ea245646a4b4386606f03c8a3916a3607e2adbbc88f000976be36db410a1e39
-
SHA512
62507685d5542cfcd394080917b3a92ca197112feea9c2ddc1dfc77382a174c7ddf758d85af66cd322692215cb0402865b2a2b212694a36da6b592028caafcdf
-
SSDEEP
3072:6gGTLRFbMdhBVHvr5eSnC6PRWhk7Bbd8+D95H0XluZ:YWBlvr5FCYRWuBbdB5wl2
Score3/10 -
-
-
Target
resources/elevate.exe
-
Size
105KB
-
MD5
792b92c8ad13c46f27c7ced0810694df
-
SHA1
d8d449b92de20a57df722df46435ba4553ecc802
-
SHA256
9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
-
SHA512
6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
-
SSDEEP
3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
Score1/10 -