Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

river.exe

windows11-21h2-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    river.exe

  • Size

    14.2MB

  • Sample

    240224-25acbahc9s

  • MD5

    c0b3efde1f2e9044209acc359fbb4228

  • SHA1

    2d77c16b5833a16f3aa16d7e84ea15c34dabbb4b

  • SHA256

    ceb8c5e642884fa6b81267e4c6234f7de4e30185e51fae9c229e14231d2efa51

  • SHA512

    feffd87b0a3081299f99db2faab15a2aadd96dfbac37fc16af4893922986fba80798b221a9d94bc32a0315f12500e6b7cb1a0f136377c5f4acfbf64e8c6ffcf7

  • SSDEEP

    393216:TLIKmr2pu0tTNk3meScGfdZaHW8p2WR+qluE7:XIKmr2puIhak5FSW8p2TE

Score
7/10
pyinstaller

Malware Config

Targets

    • Target

      river.exe

    • Size

      14.2MB

    • MD5

      c0b3efde1f2e9044209acc359fbb4228

    • SHA1

      2d77c16b5833a16f3aa16d7e84ea15c34dabbb4b

    • SHA256

      ceb8c5e642884fa6b81267e4c6234f7de4e30185e51fae9c229e14231d2efa51

    • SHA512

      feffd87b0a3081299f99db2faab15a2aadd96dfbac37fc16af4893922986fba80798b221a9d94bc32a0315f12500e6b7cb1a0f136377c5f4acfbf64e8c6ffcf7

    • SSDEEP

      393216:TLIKmr2pu0tTNk3meScGfdZaHW8p2WR+qluE7:XIKmr2puIhak5FSW8p2TE

    Score
    7/10

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks