Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/04/2024, 15:14
Static task
static1
Behavioral task
behavioral1
Sample
6.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6.dll
Resource
win10v2004-20240226-en
General
-
Target
6.dll
-
Size
809KB
-
MD5
154c624507f98b908007c38fa0b73861
-
SHA1
b8986ef6ebae6b2ad37f680d25d42f2b3fab7ed4
-
SHA256
5d881d14d2336273e531b1b3d6f2d907539fe8489cbe80533280c9c72efa2273
-
SHA512
603f4c2ea46e631f3fe215d3c93da1cd1571d6efa435f819c2236fb7ca27f5331fb79e2e79716dec9edbfac3f99a3aba1ba742a9322f7069afd951864c86966c
-
SSDEEP
12288:S/cSVrVqnK0AtRTxsdzvbFbkag0UvMzK4NWJFgVgU5Sz9duW/Tw6vhWDsghGdQx/:ccS1VqinFBdQx3VcNNWMeD
Malware Config
Extracted
latrodectus
https://fluraresto.me/live/
https://mastralakkot.live/live/
Signatures
-
Latrodectus loader
Latrodectus is a loader written in C++.
-
Detect larodectus Loader variant 1 3 IoCs
resource yara_rule behavioral1/memory/2092-0-0x0000000000150000-0x0000000000163000-memory.dmp family_latrodectus_v1 behavioral1/memory/2092-5-0x0000000000130000-0x0000000000144000-memory.dmp family_latrodectus_v1 behavioral1/memory/2092-4-0x0000000000110000-0x0000000000121000-memory.dmp family_latrodectus_v1 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2092 rundll32.exe 2092 rundll32.exe