Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Incognito.exe
-
Size
24.6MB
-
Sample
240529-2rb9radg27
-
MD5
e6178098a6a0e280e92545fb152e853f
-
SHA1
fc80241f3ddb77cc6bc775444bb1e61996413534
-
SHA256
530ca605cb86630b8bbb472aad2f5967c027b5548711feac61fc87479f47f9b3
-
SHA512
4e251aa7e73e610d9c6e3fd963bafa24d036a80e5b110b6f725570dcb56995a66677bc0a15a1b7c0f90be41239463eb2e6d6ea1ffba28feccc54bc69898a79b2
-
SSDEEP
786432:4YPDPCIuDElEqr6fMx3yHgbcWSuFBmMr1y/pW2W9:VrPCRDE4A3yHnsBmMSbW9
Behavioral task
behavioral1
Sample
Incognito.exe
Resource
win7-20240221-en
Malware Config
Targets
-
-
Target
Incognito.exe
-
Size
24.6MB
-
MD5
e6178098a6a0e280e92545fb152e853f
-
SHA1
fc80241f3ddb77cc6bc775444bb1e61996413534
-
SHA256
530ca605cb86630b8bbb472aad2f5967c027b5548711feac61fc87479f47f9b3
-
SHA512
4e251aa7e73e610d9c6e3fd963bafa24d036a80e5b110b6f725570dcb56995a66677bc0a15a1b7c0f90be41239463eb2e6d6ea1ffba28feccc54bc69898a79b2
-
SSDEEP
786432:4YPDPCIuDElEqr6fMx3yHgbcWSuFBmMr1y/pW2W9:VrPCRDE4A3yHnsBmMSbW9
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-