Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
9dbd3b6ad926385fec213cf0dc1382e34bc82c81819a824bd602dbfcd15dfaba
-
Size
416KB
-
Sample
240506-tb9lbaha9y
-
MD5
c62577dfbfc4d84bdf28058e789d0cde
-
SHA1
b5aea8ed31dc2bf448671ffb0b02739d4114e024
-
SHA256
9dbd3b6ad926385fec213cf0dc1382e34bc82c81819a824bd602dbfcd15dfaba
-
SHA512
eda35d9d46e1aeaae19956b29ba3ad8bf93a38387a13560b04b16cbd40b51b43e1bd5f226e2e3eb149ba39338f94ce14539c951de67d8b5366b5c834c0f1c053
-
SSDEEP
12288:V/36Qn32mOgeVztEMz3Jx8fnLd4S3Ntcl:t7deXP8fnRTcl
Static task
static1
Behavioral task
behavioral1
Sample
9dbd3b6ad926385fec213cf0dc1382e34bc82c81819a824bd602dbfcd15dfaba.exe
Resource
win10v2004-20240426-en
Malware Config
Extracted
stealc
http://185.172.128.150
-
url_path
/c698e1bc8a2f5e6d.php
Targets
-
-
Target
9dbd3b6ad926385fec213cf0dc1382e34bc82c81819a824bd602dbfcd15dfaba
-
Size
416KB
-
MD5
c62577dfbfc4d84bdf28058e789d0cde
-
SHA1
b5aea8ed31dc2bf448671ffb0b02739d4114e024
-
SHA256
9dbd3b6ad926385fec213cf0dc1382e34bc82c81819a824bd602dbfcd15dfaba
-
SHA512
eda35d9d46e1aeaae19956b29ba3ad8bf93a38387a13560b04b16cbd40b51b43e1bd5f226e2e3eb149ba39338f94ce14539c951de67d8b5366b5c834c0f1c053
-
SSDEEP
12288:V/36Qn32mOgeVztEMz3Jx8fnLd4S3Ntcl:t7deXP8fnRTcl
-
Detect ZGRat V1
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-