Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    8b5376bda7dabd5355e17ed2d29a76b466f5197841a35568276c843e332835b4.exe

  • Size

    651KB

  • Sample

    240603-pqlqksfg79

  • MD5

    461a238903404999e36835284a2eaaf7

  • SHA1

    d8a050750f7fdc5038d4164c8f7d247d2cecf7a9

  • SHA256

    8b5376bda7dabd5355e17ed2d29a76b466f5197841a35568276c843e332835b4

  • SHA512

    dbacc9234a74ac470839a6668899a6725c915d4ffb4c9fa27208d18cf35798bc6edef056a99e9500131257bb1d37a2cc280c9fabd409f55900f8db602368f586

  • SSDEEP

    12288:eiETpbqSE35/ohUxyWC5c5+C4PE4Y5tq1czVGZaIrKiHbts3/1MkR:WbqSE3JYwkm5+CmEjGlNrKc5M/F

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

cn26

Decoy

ajtsistemas.com

kolotylo.info

mraofficial.store

shopcupsareus.com

odishastatenews.in

yipicircle.life

bryve.shop

tempotrekstore.com

casinoslotsjoint.com

xiaoshuoxyz.com

art-birdsflyinghigh.com

odvip438.com

verlatservicios.com

bilocoin.world

lamaisonfacile.com

guojiang-v37.xyz

shsredgpoufnds.net

thequorumcompany.com

qf4h1tcpmgxor7b.skin

daisyjoanniezu.cyou

Targets

    • Target

      8b5376bda7dabd5355e17ed2d29a76b466f5197841a35568276c843e332835b4.exe

    • Size

      651KB

    • MD5

      461a238903404999e36835284a2eaaf7

    • SHA1

      d8a050750f7fdc5038d4164c8f7d247d2cecf7a9

    • SHA256

      8b5376bda7dabd5355e17ed2d29a76b466f5197841a35568276c843e332835b4

    • SHA512

      dbacc9234a74ac470839a6668899a6725c915d4ffb4c9fa27208d18cf35798bc6edef056a99e9500131257bb1d37a2cc280c9fabd409f55900f8db602368f586

    • SSDEEP

      12288:eiETpbqSE35/ohUxyWC5c5+C4PE4Y5tq1czVGZaIrKiHbts3/1MkR:WbqSE3JYwkm5+CmEjGlNrKc5M/F

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks