Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
d436b4e8a05055faa3305ed75bc0dec4f79402d0d7ef31e07883fd477498b3cb
-
Size
415KB
-
Sample
240409-atk6wsbh3z
-
MD5
4c0dc5941c1cc470e37442aa820f9dd8
-
SHA1
6e04b61dee4a41fecc03524f4f0e0e893a0d5ece
-
SHA256
d436b4e8a05055faa3305ed75bc0dec4f79402d0d7ef31e07883fd477498b3cb
-
SHA512
5ae0f33def9abb44c1184ff5598c366bd58bce75a698468a12d386ffd5fa554faae3fde238dcaa2cea46e08fed777c24203781e782c04cf0ab7aa9119a0a1d90
-
SSDEEP
6144:nFphGWg9GOLmEenm1GkAucLzpaR8gRQMGCtPvh1cGpBfHIY:FpRQcSGGckRDBPv7zHHIY
Static task
static1
Behavioral task
behavioral1
Sample
d436b4e8a05055faa3305ed75bc0dec4f79402d0d7ef31e07883fd477498b3cb.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
stealc
http://185.172.128.209
-
url_path
/3cd2b41cbde8fc9c.php
Targets
-
-
Target
d436b4e8a05055faa3305ed75bc0dec4f79402d0d7ef31e07883fd477498b3cb
-
Size
415KB
-
MD5
4c0dc5941c1cc470e37442aa820f9dd8
-
SHA1
6e04b61dee4a41fecc03524f4f0e0e893a0d5ece
-
SHA256
d436b4e8a05055faa3305ed75bc0dec4f79402d0d7ef31e07883fd477498b3cb
-
SHA512
5ae0f33def9abb44c1184ff5598c366bd58bce75a698468a12d386ffd5fa554faae3fde238dcaa2cea46e08fed777c24203781e782c04cf0ab7aa9119a0a1d90
-
SSDEEP
6144:nFphGWg9GOLmEenm1GkAucLzpaR8gRQMGCtPvh1cGpBfHIY:FpRQcSGGckRDBPv7zHHIY
-
Detect ZGRat V1
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-