Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
1f36770f712ddc39232583723f0c43d4f11d680fae143f79a8158d6a0f015702.exe
-
Size
1.9MB
-
Sample
240430-bhqsnsgc2t
-
MD5
2f12651489989cc02775433ade30799c
-
SHA1
e07f6c5cddc29edce812fa42724f07f565a7728f
-
SHA256
1f36770f712ddc39232583723f0c43d4f11d680fae143f79a8158d6a0f015702
-
SHA512
ac42fbdf5425a4cfe37af4931a0fcb3733f74e7869b45fff7ba1bf1e8b33ffa8fe2b93980fc0a0d5b3b59e38e33a7cbc597fc28a22b9aa5afac7e29b14f2cd49
-
SSDEEP
49152:IBJunqwC2ZpjeWCeemRYiEtOCTpdBAeeAY:yOGqdeWx6iMOCTpded
Static task
static1
Behavioral task
behavioral1
Sample
1f36770f712ddc39232583723f0c43d4f11d680fae143f79a8158d6a0f015702.exe
Resource
win7-20240215-en
Malware Config
Targets
-
-
Target
1f36770f712ddc39232583723f0c43d4f11d680fae143f79a8158d6a0f015702.exe
-
Size
1.9MB
-
MD5
2f12651489989cc02775433ade30799c
-
SHA1
e07f6c5cddc29edce812fa42724f07f565a7728f
-
SHA256
1f36770f712ddc39232583723f0c43d4f11d680fae143f79a8158d6a0f015702
-
SHA512
ac42fbdf5425a4cfe37af4931a0fcb3733f74e7869b45fff7ba1bf1e8b33ffa8fe2b93980fc0a0d5b3b59e38e33a7cbc597fc28a22b9aa5afac7e29b14f2cd49
-
SSDEEP
49152:IBJunqwC2ZpjeWCeemRYiEtOCTpdBAeeAY:yOGqdeWx6iMOCTpded
-
Detect ZGRat V1
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Detects executables packed with unregistered version of .NET Reactor
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-