Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Tidal Installer.exe
-
Size
3.3MB
-
Sample
240708-wmftgstfjc
-
MD5
928c096b170bbcfd789c2268bbcab9b4
-
SHA1
0ef18c6ba24139b948dc8edfa1e58355eca1134f
-
SHA256
b172ceb8fabfc98c6384540a45beb3dbc05d6a85fdf86e1878079c77ff3be80b
-
SHA512
9f68618103ad9cd1a79c9816be945783c61f9744c01156f384aa73cfe62552fca080f806db0de04ea74d2e0b05a06c50382de14530442e7630c08c3d48a94117
-
SSDEEP
98304:vRm0mz8HH3Uh8Lk8W2Zs2blQCccENb+Y7anx:ZTC8kck72BQDcib+Y7
Malware Config
Targets
-
-
Target
Tidal Installer.exe
-
Size
3.3MB
-
MD5
928c096b170bbcfd789c2268bbcab9b4
-
SHA1
0ef18c6ba24139b948dc8edfa1e58355eca1134f
-
SHA256
b172ceb8fabfc98c6384540a45beb3dbc05d6a85fdf86e1878079c77ff3be80b
-
SHA512
9f68618103ad9cd1a79c9816be945783c61f9744c01156f384aa73cfe62552fca080f806db0de04ea74d2e0b05a06c50382de14530442e7630c08c3d48a94117
-
SSDEEP
98304:vRm0mz8HH3Uh8Lk8W2Zs2blQCccENb+Y7anx:ZTC8kck72BQDcib+Y7
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-