Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
ROTMG.dll
-
Size
29.5MB
-
Sample
240416-1f2vladc63
-
MD5
f20bf250ba777687a9b5eaf13d69bc04
-
SHA1
f72b2d9e0f2e90b3c5b7750cbed115329a1b4c61
-
SHA256
fc68234698eb7be477342c2b7903acc38726be045e1d85071f8a3180b67708ad
-
SHA512
ee8d50c0f123f5eef40973dc29ab8e4ec808656d6309fef0b0abd7be25b0ec58947938f67373a79fcdddbe263eaa6d0514b830675bf3e095bae9c2d553344079
-
SSDEEP
786432:JcLg+VeLX/7L+Rysyw/iDpxbaSBXDdaKulsB++P8s:JcLg+VEP7qRys1/iD6wRzulab
Malware Config
Targets
-
-
Target
ROTMG.dll
-
Size
29.5MB
-
MD5
f20bf250ba777687a9b5eaf13d69bc04
-
SHA1
f72b2d9e0f2e90b3c5b7750cbed115329a1b4c61
-
SHA256
fc68234698eb7be477342c2b7903acc38726be045e1d85071f8a3180b67708ad
-
SHA512
ee8d50c0f123f5eef40973dc29ab8e4ec808656d6309fef0b0abd7be25b0ec58947938f67373a79fcdddbe263eaa6d0514b830675bf3e095bae9c2d553344079
-
SSDEEP
786432:JcLg+VeLX/7L+Rysyw/iDpxbaSBXDdaKulsB++P8s:JcLg+VEP7qRys1/iD6wRzulab
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-