Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
3Spoofer-1....32.exe
windows10-2004-x64
8$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI..._3.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows10-2004-x64
3$SYSDIR/Packet.dll
windows10-2004-x64
1$SYSDIR/pthreadVC.dll
windows10-2004-x64
1$SYSDIR/wpcap.dll
windows10-2004-x64
1WinPcapInstall.dll
windows10-2004-x64
3rpcapd.exe
windows10-2004-x64
1$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...86.exe
windows10-2004-x64
7firewall.vbs
windows10-2004-x64
1restore.exe
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3scamper.exe
windows10-2004-x64
1spoofer-cli.exe
windows10-2004-x64
1spoofer-gui.exe
windows10-2004-x64
1spoofer-prober.exe
windows10-2004-x64
1spoofer-scheduler.exe
windows10-2004-x64
1uninstall.exe
windows10-2004-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3General
-
Target
Spoofer-1.4.12-win32.exe
-
Size
16.4MB
-
Sample
240720-bew6aayhpm
-
MD5
190f8d40317a803cc9f85dc556dc5e5a
-
SHA1
d30e05e0d45e3317718872b938b3f4bec68629bd
-
SHA256
aa7f639048e93e2a842f94d592dcc4334d16dd583fe849cc88bbb97f5f0b8997
-
SHA512
fb7bf3b4e658db6de607670907e8089bca5898f9c3f6e9e31ec9c29afc5af26cde388935cee60f41ec3836c7f90c6caa78c785bfdc23e497a1ee99c0a374d80a
-
SSDEEP
393216:m6NDjZxu6GiVEBqFz8BMK5rV123ebF7JAzfI88+PXGPd/Do:3ZhGi8qp8BM2rVAuZ2ImiDo
Static task
static1
Behavioral task
behavioral1
Sample
Spoofer-1.4.12-win32.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/WinPcap_4_1_3.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
$SYSDIR/Packet.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral6
Sample
$SYSDIR/pthreadVC.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
$SYSDIR/wpcap.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral8
Sample
WinPcapInstall.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
rpcapd.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/vc2012u4redist_x86.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
firewall.vbs
Resource
win10v2004-20240709-en
Behavioral task
behavioral14
Sample
restore.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral16
Sample
scamper.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
spoofer-cli.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral18
Sample
spoofer-gui.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
spoofer-prober.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral20
Sample
spoofer-scheduler.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
uninstall.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
Spoofer-1.4.12-win32.exe
-
Size
16.4MB
-
MD5
190f8d40317a803cc9f85dc556dc5e5a
-
SHA1
d30e05e0d45e3317718872b938b3f4bec68629bd
-
SHA256
aa7f639048e93e2a842f94d592dcc4334d16dd583fe849cc88bbb97f5f0b8997
-
SHA512
fb7bf3b4e658db6de607670907e8089bca5898f9c3f6e9e31ec9c29afc5af26cde388935cee60f41ec3836c7f90c6caa78c785bfdc23e497a1ee99c0a374d80a
-
SSDEEP
393216:m6NDjZxu6GiVEBqFz8BMK5rV123ebF7JAzfI88+PXGPd/Do:3ZhGi8qp8BM2rVAuZ2ImiDo
Score8/10-
Creates new service(s)
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
-
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
2ae993a2ffec0c137eb51c8832691bcb
-
SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1
-
SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
-
SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
SSDEEP
192:vPtkumJX7zB22kGwfy0mtVgkCPOsE1un:k702k5qpdsEQn
Score3/10 -
-
-
Target
$PLUGINSDIR/WinPcap_4_1_3.exe
-
Size
893KB
-
MD5
a11a2f0cfe6d0b4c50945989db6360cd
-
SHA1
e2516fcd1573e70334c8f50bee5241cdfdf48a00
-
SHA256
fc4623b113a1f603c0d9ad5f83130bd6de1c62b973be9892305132389c8588de
-
SHA512
2652d84eb91ca7957b4fb3ff77313e5dae978960492669242df4f246296f1bedaa48c0d33ffb286b2859a1b86ef5460060b551edca597b4ec60ee08676877c70
-
SSDEEP
24576:UBOldyR6ORWsaM2QROxa6jsqUENfJjNK/CG6niqiL:2KzqWsayROxa6QDENuaG+ifL
Score7/10-
Loads dropped DLL
-
-
-
Target
$PLUGINSDIR/InstallOptions.dll
-
Size
14KB
-
MD5
325b008aec81e5aaa57096f05d4212b5
-
SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3
-
SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
-
SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
-
SSDEEP
192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
Score3/10 -
-
-
Target
$SYSDIR/Packet.dll
-
Size
99KB
-
MD5
2ce150705bbeb30e6c8059cc530043aa
-
SHA1
3d8615f9d8f8f7a5d78b3c06bf746948b9ef6ba5
-
SHA256
cd9f4fb077c25013226e0883f9ae02e9ced9b71f07637081e55ae70fd0788f29
-
SHA512
9f7573ca679ef0cc0e1d815f605a399e87f7a046e3e51970d2c7597329b19e118cc2da7240ee854e13e31582f12bab8be506d1612ac81d5b453ef366d4674dcf
-
SSDEEP
1536:zbDKMXRC2wKDDuDirGfqs97WcETlsxtl2o+V:PDKMtfuysAcETlsxtco8
Score1/10 -
-
-
Target
$SYSDIR/pthreadVC.dll
-
Size
52KB
-
MD5
f04a90f917ba10ae2dcbe859870f4dea
-
SHA1
6668ebe373ce58c33017697c477557653427e626
-
SHA256
99c61abf41c3aec38cab3ed6270adbca9a247bbf5f9aa9d29ecb0659a5527f48
-
SHA512
aec29301b9ce311b27f1590b0e0c4121acdc183a30b570e087d77b7035684f02a6dfbdee950c37f3023b32e2ea5a075a5fbe6d18a2804da9490d4959733bb516
-
SSDEEP
384:hSvfC8Vv0Vy7ojuq7GQcdWTc4zU+GFronD/yD5rBEe0kiH32Jp9AhOW:wt+TGQcdWYdMG59EeJiH3YzW
Score1/10 -
-
-
Target
$SYSDIR/wpcap.dll
-
Size
275KB
-
MD5
4633b298d57014627831ccac89a2c50b
-
SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b
-
SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
-
SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
-
SSDEEP
6144:E4yIm5rC9WNWwKcNBSCiLvK8+jKgZBwIbg2:jyIm59WwpqCuEKIwv2
Score1/10 -
-
-
Target
WinPcapInstall.dll
-
Size
91KB
-
MD5
e78291558cb803dfd091ad8fb56feecc
-
SHA1
4bde2f87e903fe8d3bd80179c5584cec7a8cbdc4
-
SHA256
d9f4cd9f0e1bc9a138fb4da6f83c92c3e86eb3de4f988d5943d75c9b1dc6bb9d
-
SHA512
042b96bc2c0e6d8b6e2730426938eb7400fd833be8a108a4942f559fedefabc35fd5dcb7ea1898d377b4382c0a9af8eeeebd663a4c852c706e3bd168c1f1f62f
-
SSDEEP
1536:s7xjrG5m+619YG7L2xo8JfmL4iMtgLZtAeYjFH:s7s27yaL4kVtAeE9
Score3/10 -
-
-
Target
rpcapd.exe
-
Size
115KB
-
MD5
83a6c2cafe236652d1559640594a0ea8
-
SHA1
c99aa678f387c00c4470fa3cd7b037d26720960d
-
SHA256
52360f17c9c70c9cea3316560b40c4d89fd705ed7e6b6088c99fc54d4cc35eb5
-
SHA512
4f6981c4e8d64311087795e9639516409bf80ebca5c7f25af1fb436aaccf90f24617ecd3f95b63558981b12bc0e5eeacf120fea7be5e5fa05ecf3afa4f9f799b
-
SSDEEP
3072:mL7m5RTfrUna0m2BeIIgJ3155FulLfbt/6:C7m5RTEaseIH515qfA
Score1/10 -
-
-
Target
$PLUGINSDIR/nsDialogs.dll
-
Size
9KB
-
MD5
13b6a88cf284d0f45619e76191e2b995
-
SHA1
09ebb0eb4b1dca73d354368414906fc5ad667e06
-
SHA256
cb958e21c3935ef7697a2f14d64cae0f9264c91a92d2deeb821ba58852dac911
-
SHA512
2aeeae709d759e34592d8a06c90e58aa747e14d54be95fb133994fdcebb1bdc8bc5d82782d0c8c3cdfd35c7bea5d7105379d3c3a25377a8c958c7b2555b1209e
-
SSDEEP
96:oyqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4yqndYHnxss:oyq+CP3uKrpyREs06YxKdGn
Score3/10 -
-
-
Target
$PLUGINSDIR/nsExec.dll
-
Size
6KB
-
MD5
b648c78981c02c434d6a04d4422a6198
-
SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2
-
SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
-
SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
SSDEEP
96:U7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNN3e:mXhHR0aTQN4gRHdMqJVgNE
Score3/10 -
-
-
Target
$PLUGINSDIR/vc2012u4redist_x86.exe
-
Size
6.3MB
-
MD5
7f52a19ecaf7db3c163dd164be3e592e
-
SHA1
96b377a27ac5445328cbaae210fc4f0aaa750d3f
-
SHA256
b924ad8062eaf4e70437c8be50fa612162795ff0839479546ce907ffa8d6e386
-
SHA512
60220a7c9de72796bd0d6d44e2b82dbdd9c850cc611e505b7dc0213f745ff1f160b2d826eaf62fd6e07c1a31786a71d83dc6e94389690fd59b895e85aba7444b
-
SSDEEP
196608:OwKjLs+UIkzHlAv4X6zQRgiwHLD2LQIX/:9KjaxFFP1iLD2LnP
Score7/10-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
-
-
Target
firewall.vbs
-
Size
7KB
-
MD5
c3968ffa8424213e2e6310acb096dca3
-
SHA1
0b2d19d0d88dbe60e0d83b8e400d3aad42713e1f
-
SHA256
81b19ab7f09ef712e30c43c94f9ce5997eeae920036180d597d0c251dbb95f9d
-
SHA512
b9198890f6ec781ebfe177839749dc50491b1e42d04ba6cde1d056c053cd6516e1c8e555800354ebf7ac5135efc3356c5d7249940c59e21fd40086d0b63f381c
-
SSDEEP
192:0L690jFCEStelEbmelFelbrelselLrel4es:0Le0jcEStEEbmEFEbrEsELrE4v
Score1/10 -
-
-
Target
restore.exe
-
Size
50KB
-
MD5
9015443f318603ed9cc41e99b0e09852
-
SHA1
25f5e5a9cf637afcd4fc06a4afbda346ea1fb991
-
SHA256
78b392efd469a87c4cdfba17088dadb00b0f1f2377e1b219770c9f8a13c99cea
-
SHA512
6e6071975edae7271d04573a669b4e037df48623e3309831405b905831f98a53c1e279c661247f17c4df601851e3254478fb5874ede1ffe3bac6d3893ed0118c
-
SSDEEP
1536:9PzUmdx2gahvwPBW7rfoOcKE+P8fhgPxP:9PzUQ2gyYqrf5cKE+8fexP
Score3/10 -
-
-
Target
$PLUGINSDIR/nsExec.dll
-
Size
6KB
-
MD5
b648c78981c02c434d6a04d4422a6198
-
SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2
-
SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
-
SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
SSDEEP
96:U7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNN3e:mXhHR0aTQN4gRHdMqJVgNE
Score3/10 -
-
-
Target
scamper.exe
-
Size
562KB
-
MD5
1650501263db72ccd9a49052a0bc3779
-
SHA1
2118068d8ad8a36005cc459cbeb88d5dd869e0cf
-
SHA256
66eff9a868c58c87304c793215342596f0340326ce240f8889a6535c314cec90
-
SHA512
8887df0cff41da2508d3b91f9563c445fcae06d974124ab73eec692aa10dce6cd90cd7291c1e723c02dcde10d945dcdce5fee98cc2eeb57bd40507718fd92313
-
SSDEEP
12288:m+Gw+xtyxbA4LzFQMEFIVTHycyv2U8kTY7Pm1MSEIOwFFIkxK:m+GmA4PEY7O6M4
Score1/10 -
-
-
Target
spoofer-cli.exe
-
Size
4.1MB
-
MD5
b887f35bf2abd1d4adcadada36df9194
-
SHA1
8eabfb742601d85523e680586a69cd2e624177a2
-
SHA256
6f57a449f8098b4d1a1ac4f1626b61d5fcaccbc2f1e995dfd6699a37521586b8
-
SHA512
fb15bc1c6cf456142120a81937ad9da9fa5a9af61c7333d200b3ac3469763c2919f54f2a38c37e21095a50510e3f99614dbb54ee37458ea61bdd5743430213af
-
SSDEEP
98304:qzvQBUB9q4tZp3L84ccneowRaHPLejJsv6tWKFdu9CP:qjLtZxI4HRFHPyjJsv6tWKFdu9CP
Score1/10 -
-
-
Target
spoofer-gui.exe
-
Size
15.4MB
-
MD5
1cebd49aff235e71aff3a61af6c858cb
-
SHA1
a2d52c0551e8733596def57c245dda9412f3b1a5
-
SHA256
ea6736954b9419b97ac26ee2ce6d6ad0306ee22d66129f36015a7fce7a3b51a4
-
SHA512
d4a257b7c049c46384969400fc68835ac87efc6401aa63f0bc1f0afb2b99fedcd579686f37f7465d153a4c15ed38f099778b36b8b5aecb7d2ed69ea75e570e6c
-
SSDEEP
393216:HRdvgMgXHVU0YJNyDLx250j53VA2Jsv6tWKFdu9CFi:vvHgX1U7JNaXi
Score1/10 -
-
-
Target
spoofer-prober.exe
-
Size
3.9MB
-
MD5
0d44f3d45865cf66568b9ce024d499d0
-
SHA1
5eaf990e07bda43685939ac45c71be05efdb4faf
-
SHA256
2bd691977c54e5bb4a16385c4345fafd60f1482bcea5cca19727037eb967104d
-
SHA512
2e8a2e4242175804b3458433f3fba5b225a0eeb4996da2ea83b44b6df7bca77207d81d17675522074994e0ea5be4d469aec49b2e2ae5ee3f2d87688511e68eb3
-
SSDEEP
98304:WmCeOXQQ2C/hjN/lQsvkASr2oB6W5IljehL8Xdlrl8ogyhNpaEON:W/dXQQ2CpjN/lQsvkASCyjIlje2vuoxc
Score1/10 -
-
-
Target
spoofer-scheduler.exe
-
Size
7.9MB
-
MD5
2b571ef2d50ed9f42d09a34899358b17
-
SHA1
81c1bef20a6f57695199558dee6e0b02c78ff473
-
SHA256
4a0b7ca3b39fa30914f0117d87dcf636490bb590f1e35a86689982b5ec3848a7
-
SHA512
8302d6862eb5f4aa6a376dd46e68e780038aef6a570f39e315210e03de203bda0c35c5565283920d3a4fef1b3a99f6cbaf2160791f77d54444d9c207dea394b3
-
SSDEEP
196608:TXmy72T4NQdwQ1qWAVCB3GAB5VTPCNiwEk7BHwrxKBXbvPJsv6tWKFdu9C7:DgJNCsL+HwiXbHJsv6tWKFdu9C7
Score1/10 -
-
-
Target
uninstall.exe
-
Size
215KB
-
MD5
914b81b73db039e10b78a3e343d3e7ba
-
SHA1
523826dc6bfa4e4547fd0b7df2f0b3b4488b007e
-
SHA256
44c2d3973b2ef0276821f9f744f4a003249780cda4a98eb26435f5d37fd2efa4
-
SHA512
dce3713d9b736bec95e9f0db4120d5e06c4db8f968eb350463246b383561464048f5690b7686c7c37191ff2981e7ee73b46b952f43632f4d8fdfd042abe40507
-
SSDEEP
3072:KPzUQ2gyYqrf5cChh7rR0rW5VrjL4XR6XsbmyE2hN2DwYi8fax5:KMfvhh7r2rWrsh/bmyE/DwOfW
Score3/10 -
-
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
2ae993a2ffec0c137eb51c8832691bcb
-
SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1
-
SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
-
SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
SSDEEP
192:vPtkumJX7zB22kGwfy0mtVgkCPOsE1un:k702k5qpdsEQn
Score3/10 -
-
-
Target
$PLUGINSDIR/nsDialogs.dll
-
Size
9KB
-
MD5
13b6a88cf284d0f45619e76191e2b995
-
SHA1
09ebb0eb4b1dca73d354368414906fc5ad667e06
-
SHA256
cb958e21c3935ef7697a2f14d64cae0f9264c91a92d2deeb821ba58852dac911
-
SHA512
2aeeae709d759e34592d8a06c90e58aa747e14d54be95fb133994fdcebb1bdc8bc5d82782d0c8c3cdfd35c7bea5d7105379d3c3a25377a8c958c7b2555b1209e
-
SSDEEP
96:oyqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx4yqndYHnxss:oyq+CP3uKrpyREs06YxKdGn
Score3/10 -
-
-
Target
$PLUGINSDIR/nsExec.dll
-
Size
6KB
-
MD5
b648c78981c02c434d6a04d4422a6198
-
SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2
-
SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
-
SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
SSDEEP
96:U7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNN3e:mXhHR0aTQN4gRHdMqJVgNE
Score3/10 -