Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

Okthabah.exe

windows7-x64

8

Okthabah.exe

windows10-2004-x64

8

Resubmissions

16/05/2024, 17:55

240516-whltyagg49 8

16/05/2024, 17:41

240516-v9rc3aga5w 8

16/05/2024, 17:28

240516-v2byeafg62 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Okthabah.exe

  • Size

    434KB

  • Sample

    240516-v9rc3aga5w

  • MD5

    66affb0ca8f6d6370cc61db763a1031f

  • SHA1

    b1bb40419c56cb0418d7657f4fb9cfefca902d44

  • SHA256

    68ac1c517be7a28e59ed717f6e2ed7b94f81ae595ded1454f38c928fbaad6b71

  • SHA512

    b305a5de0b8c91d0a3f376ed71ca8f456cab74f993bf73c2cccee452a3ff54e7c50eaac13efc003ff8c531f35fb12f45334003ab1caffb95f137ff85800bce80

  • SSDEEP

    12288:IR3eJ+U4Q9O1cj/jIkfLKi/0B9eK59c+4uzCf9uJWRU:o3eJ+Ung8/jIkf2taK59c+hO+EU

Score
8/10
executionpersistence

Malware Config

Targets

    • Target

      Okthabah.exe

    • Size

      434KB

    • MD5

      66affb0ca8f6d6370cc61db763a1031f

    • SHA1

      b1bb40419c56cb0418d7657f4fb9cfefca902d44

    • SHA256

      68ac1c517be7a28e59ed717f6e2ed7b94f81ae595ded1454f38c928fbaad6b71

    • SHA512

      b305a5de0b8c91d0a3f376ed71ca8f456cab74f993bf73c2cccee452a3ff54e7c50eaac13efc003ff8c531f35fb12f45334003ab1caffb95f137ff85800bce80

    • SSDEEP

      12288:IR3eJ+U4Q9O1cj/jIkfLKi/0B9eK59c+4uzCf9uJWRU:o3eJ+Ung8/jIkf2taK59c+hO+EU

    Score
    8/10
    executionpersistence

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks