Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

7

gasai_crac...ai.exe

windows11-21h2-x64

7

gasai_crac...er.exe

windows11-21h2-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    gasai_cracked.rar

  • Size

    131.2MB

  • Sample

    240703-2p3zpazdmq

  • MD5

    993ba76feaa66ef9fea86dc7b09d0917

  • SHA1

    bc8a743c6abde273ce9041bdb066f176311cc77c

  • SHA256

    11f4df813c48e10e73fd67eb66b1f6c4864fb9ef2df6f7893f53b9d2035918a4

  • SHA512

    0f0b1349b3b27c647d8db61cf501e2b2fac68933f3e3d19dddc2591044a8f21f80455807bf92eee55f3baf36704457a1b396becad5eecb15ba3f3b6d1e4f4cb4

  • SSDEEP

    3145728:8/r/50E+8cwNrHOBgMaYNiSWkpneF+yk9LFWaQQVsF9dtJKI:8jW0cKruB9nNiSZ3FWaQusF9dt

Score
9/10
evasionpyinstallerthemida

Malware Config

Targets

    • Target

      gasai_cracked/Gasai.exe

    • Size

      101.8MB

    • MD5

      be4c06fafcf75bea728c6fc5c9a8bd8d

    • SHA1

      c610f057ed82a128d0360d10160bcefe40e05ad4

    • SHA256

      efbce42a1ef148232051b6396f21f308b2fb14e5332dbf0599393187a548abd8

    • SHA512

      d126dadb5f67d4d04691d20ae2d22c30b8f39004ff18805d0336109adcbc4d882db4250df484fe404a69c29b4bf8e623414997d79885b8c70395714fa9b7d0c2

    • SSDEEP

      3145728:bWpiySwgYRaISeDB1jdvHqpN/SC++VN/SLqrn0/fu/f:bWoySwx2s1jVKSCcqV

    Score
    7/10

    • Loads dropped DLL

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

    • Target

      gasai_cracked/launcher.exe

    • Size

      4.9MB

    • MD5

      05bc8e2e0473d2bcb2d959d5ecde2d37

    • SHA1

      555f073467bbc064db4049d3ea6be5221d601d72

    • SHA256

      1e13949291b38b35ff7ae80f701ca50753e47472c3667470a82a5206ad6d9801

    • SHA512

      645297f215c4734acbb8d580f9be220cd42a8a7d9bcf3f08b149cbd1e4f867c06252f44915317052ee66599de7401def0f8477eae40973e680c247bc4293c88e

    • SSDEEP

      98304:YKRGpvYMi4MIMPgQesZCWV9yfmYGefQBZaLHNjj5YdRBuwo:YIiv9iqMPzyHGef0SB5Y1

    Score
    9/10
    evasionthemida

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral2

MITRE ATT&CK Enterprise v15

Tasks