Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Bald.Win_New_Temp_Swoofer.exe
-
Size
4.6MB
-
Sample
240615-z1dstsvakd
-
MD5
76761b94d0187562e9acc8feb0d36111
-
SHA1
40d118971e1c9e1e96264b23772ba0ec5e159a0c
-
SHA256
d02f513e1673e5012e916fad43e0672ee0ff9cdfbc0733401b9b8fd4bd88d1f3
-
SHA512
d48731994aae2c6f7b86edf22f843913568ade13e482154b71798c7b37b62e617c0f6960b3c9ba8db5c70d173ff0ef864f9c2467d7db6fb5d617a88a301c1423
-
SSDEEP
98304:L/hllE2G7C2b9cH1UWzfW4Npy2K176ylIqdF8J8mK98wbRNVGllXLTPhCPzH00pE:LxlCcH1BSBvrltsY9jDqXLVaL7u
Malware Config
Targets
-
-
Target
Bald.Win_New_Temp_Swoofer.exe
-
Size
4.6MB
-
MD5
76761b94d0187562e9acc8feb0d36111
-
SHA1
40d118971e1c9e1e96264b23772ba0ec5e159a0c
-
SHA256
d02f513e1673e5012e916fad43e0672ee0ff9cdfbc0733401b9b8fd4bd88d1f3
-
SHA512
d48731994aae2c6f7b86edf22f843913568ade13e482154b71798c7b37b62e617c0f6960b3c9ba8db5c70d173ff0ef864f9c2467d7db6fb5d617a88a301c1423
-
SSDEEP
98304:L/hllE2G7C2b9cH1UWzfW4Npy2K176ylIqdF8J8mK98wbRNVGllXLTPhCPzH00pE:LxlCcH1BSBvrltsY9jDqXLVaL7u
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-