Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

5b0b733c5a...3a.exe

windows7-x64

10

5b0b733c5a...3a.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Efterbrnde...31.pot

windows7-x64

1

Efterbrnde...31.pot

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe

  • Size

    784KB

  • Sample

    240312-c6geksdh6v

  • MD5

    e49773c89d735bf9e427e4108dce8a0e

  • SHA1

    fbca00f3b541bc57ca9308a291184a1d38f59da0

  • SHA256

    5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a

  • SHA512

    4f24777d0156d3b09555a41e8bbebcb4b32c0686e2c856c2169e9a74be7e779f281b9ac00a02f2a91faf99c5dd26134e1b05bcf386ac08ad0b59786f496d3e24

  • SSDEEP

    12288:c1nnU0REibppIBGG7B0bnwHpXNdQFQu+0TFpg6sFbY/zbWgpil1II7MlBcNQlY:unfrb3IBGGl0bydNdQahUj62i7Xy+

Score
10/10
guloaderdownloader

Malware Config

Targets

    • Target

      5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a.exe

    • Size

      784KB

    • MD5

      e49773c89d735bf9e427e4108dce8a0e

    • SHA1

      fbca00f3b541bc57ca9308a291184a1d38f59da0

    • SHA256

      5b0b733c5af1d0a28a8a117ec03f46d16b3a4e3b1b45a5eae3d15e09dff92b3a

    • SHA512

      4f24777d0156d3b09555a41e8bbebcb4b32c0686e2c856c2169e9a74be7e779f281b9ac00a02f2a91faf99c5dd26134e1b05bcf386ac08ad0b59786f496d3e24

    • SSDEEP

      12288:c1nnU0REibppIBGG7B0bnwHpXNdQFQu+0TFpg6sFbY/zbWgpil1II7MlBcNQlY:unfrb3IBGGl0bydNdQahUj62i7Xy+

    Score
    10/10
    guloaderdownloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      acd12e950b2ced1b5690f682d2c15b25

    • SHA1

      639a1d0aaf669896377074281186cb6372811fd6

    • SHA256

      6a28f1529bd59bc04f0519e086d2946ec4f09f5e4e6f30d2afb3c3585001dccf

    • SHA512

      131bd07208d2d8c18ee9da36ce95e3c4a8d8acbb55fa96fc5a0affbc1d6e6b0ca733e9dd70ef1d5a0e15f91d88dbe1fe2c0656ea80b5a51e536ac54ab53110b4

    • SSDEEP

      192:qA1YOTDExj7EFrYCT4E8y3hoSdtTgwF43E7QbGPXI9uIc6w79Mw:+R7SrtTv53tdtTgwF4SQbGPX36wJMw

    Score
    3/10
    behavioral3behavioral4

    • Target

      Efterbrndernes/Barnaby/Salviniaceous/Alar/Gonadic131.pot

    • Size

      35KB

    • MD5

      2f5f902edfecac3a9d4116df30075d69

    • SHA1

      416fa1751926a7b755b8ad5fbeb72a5e98e8deb2

    • SHA256

      6c301208b1202c52ce208546d634a55c5e58b4515bee44c11f377f2d6a931fc8

    • SHA512

      e8b13a13e548f142186b0ae81601d7bd1dedd0a6d1e4af30e477edae6880721e90e8256e2d0cbce5478a1bb3602c6169e09ebd872f7663a7d81e709a9c6d8984

    • SSDEEP

      768:HpRboDcBs+WIpxtRQfCJM2I/rg8AT5uin0:fqfiefx/MQ

    Score
    1/10
    behavioral5behavioral6

MITRE ATT&CK Enterprise v15

Tasks