Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
25ce71f672ff93bb653f896cd1d8d6d709d3944b7808841bb3a9baf61cf76922
-
Size
1.8MB
-
Sample
240624-wfhz9syakl
-
MD5
e40eb66a60ba4358e267af03cacc02b0
-
SHA1
23dc5e34261e8f626ef95c421f3a210cb73322d9
-
SHA256
25ce71f672ff93bb653f896cd1d8d6d709d3944b7808841bb3a9baf61cf76922
-
SHA512
a1ea1dbdb48b77a45e13646ccff7e550b5341a32be1dbfb240927169d8816b4516571b6325a61c400e0284a32d693c4cb99bd70e44713e47a8bb5a4bb4f63043
-
SSDEEP
49152:pLuAIu8Qw65bWWZ/Tramocgh9fes6tZ2:8Dr4KWlrancgh92
Static task
static1
Behavioral task
behavioral1
Sample
25ce71f672ff93bb653f896cd1d8d6d709d3944b7808841bb3a9baf61cf76922.exe
Resource
win10v2004-20240611-en
Malware Config
Extracted
amadey
8254624243
e76b71
http://77.91.77.81
-
install_dir
8254624243
-
install_file
axplong.exe
-
strings_key
90049e51fabf09df0d6748e0b271922e
-
url_paths
/Kiru9gu/index.php
Targets
-
-
Target
25ce71f672ff93bb653f896cd1d8d6d709d3944b7808841bb3a9baf61cf76922
-
Size
1.8MB
-
MD5
e40eb66a60ba4358e267af03cacc02b0
-
SHA1
23dc5e34261e8f626ef95c421f3a210cb73322d9
-
SHA256
25ce71f672ff93bb653f896cd1d8d6d709d3944b7808841bb3a9baf61cf76922
-
SHA512
a1ea1dbdb48b77a45e13646ccff7e550b5341a32be1dbfb240927169d8816b4516571b6325a61c400e0284a32d693c4cb99bd70e44713e47a8bb5a4bb4f63043
-
SSDEEP
49152:pLuAIu8Qw65bWWZ/Tramocgh9fes6tZ2:8Dr4KWlrancgh92
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-