Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Okthabah.exe
-
Size
434KB
-
Sample
240516-v9rc3aga5w
-
MD5
66affb0ca8f6d6370cc61db763a1031f
-
SHA1
b1bb40419c56cb0418d7657f4fb9cfefca902d44
-
SHA256
68ac1c517be7a28e59ed717f6e2ed7b94f81ae595ded1454f38c928fbaad6b71
-
SHA512
b305a5de0b8c91d0a3f376ed71ca8f456cab74f993bf73c2cccee452a3ff54e7c50eaac13efc003ff8c531f35fb12f45334003ab1caffb95f137ff85800bce80
-
SSDEEP
12288:IR3eJ+U4Q9O1cj/jIkfLKi/0B9eK59c+4uzCf9uJWRU:o3eJ+Ung8/jIkf2taK59c+hO+EU
Static task
static1
Behavioral task
behavioral1
Sample
Okthabah.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Okthabah.exe
Resource
win10v2004-20240226-en
Malware Config
Targets
-
-
Target
Okthabah.exe
-
Size
434KB
-
MD5
66affb0ca8f6d6370cc61db763a1031f
-
SHA1
b1bb40419c56cb0418d7657f4fb9cfefca902d44
-
SHA256
68ac1c517be7a28e59ed717f6e2ed7b94f81ae595ded1454f38c928fbaad6b71
-
SHA512
b305a5de0b8c91d0a3f376ed71ca8f456cab74f993bf73c2cccee452a3ff54e7c50eaac13efc003ff8c531f35fb12f45334003ab1caffb95f137ff85800bce80
-
SSDEEP
12288:IR3eJ+U4Q9O1cj/jIkfLKi/0B9eK59c+4uzCf9uJWRU:o3eJ+Ung8/jIkf2taK59c+hO+EU
Score8/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-