Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Tidal Installer.exe

  • Size

    3.3MB

  • Sample

    240708-wmftgstfjc

  • MD5

    928c096b170bbcfd789c2268bbcab9b4

  • SHA1

    0ef18c6ba24139b948dc8edfa1e58355eca1134f

  • SHA256

    b172ceb8fabfc98c6384540a45beb3dbc05d6a85fdf86e1878079c77ff3be80b

  • SHA512

    9f68618103ad9cd1a79c9816be945783c61f9744c01156f384aa73cfe62552fca080f806db0de04ea74d2e0b05a06c50382de14530442e7630c08c3d48a94117

  • SSDEEP

    98304:vRm0mz8HH3Uh8Lk8W2Zs2blQCccENb+Y7anx:ZTC8kck72BQDcib+Y7

Malware Config

Targets

    • Target

      Tidal Installer.exe

    • Size

      3.3MB

    • MD5

      928c096b170bbcfd789c2268bbcab9b4

    • SHA1

      0ef18c6ba24139b948dc8edfa1e58355eca1134f

    • SHA256

      b172ceb8fabfc98c6384540a45beb3dbc05d6a85fdf86e1878079c77ff3be80b

    • SHA512

      9f68618103ad9cd1a79c9816be945783c61f9744c01156f384aa73cfe62552fca080f806db0de04ea74d2e0b05a06c50382de14530442e7630c08c3d48a94117

    • SSDEEP

      98304:vRm0mz8HH3Uh8Lk8W2Zs2blQCccENb+Y7anx:ZTC8kck72BQDcib+Y7

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Checks whether UAC is enabled

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks