Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
UnderWars.rar
-
Size
74.4MB
-
Sample
240421-r8y5qseb2z
-
MD5
c90d343e960c2a7773097bfd4075f2f5
-
SHA1
79d68e67e2aea53f9d3c5a0ae58262cd28bba0f0
-
SHA256
e0005227c3c8d598d73108b95758f2a64cc92305614bb111d5e9526a1201ed81
-
SHA512
bee3c872ac104dcac82453b09307620834fa4045b1d0325ad4785585ad57199b49177360c895ce7486861d0fe1dce02d3e5642c97990bbb646a6f4ebeceb9fce
-
SSDEEP
1572864:2g6LBYKH0aXsYQi2Jrydy7gJnsI0SNcucgzxTMWIyXYQ9:2juWcR3rEy8JnsqN0QMWV
Malware Config
Targets
-
-
Target
UnderWars.exe
-
Size
74.4MB
-
MD5
07459ba6359ffa670886e62d763f6614
-
SHA1
3f582004f412cea04e164256f1268e2341a0a750
-
SHA256
7ab82c1ffa37f1538594cc5ad56f6dd047baf2c30bfcce614f1ad28b56196d35
-
SHA512
5c6b6ab9a73a11702fcffeae3b6eb72b6e30870d14da36b2232e6fd53579960e166fb948d9576768fee2504273d60607c097f9220007486b4c62b7ac89d83bba
-
SSDEEP
1572864:rg6LBYKH0aXsYQi2Jrydy7gJnsI0SNcucgzxTMWIyXYQ:rjuWcR3rEy8JnsqN0QMW
Score7/10-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-