Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    6065dde59728d97cc4e8a1ea9507ebc0N.exe

  • Size

    326KB

  • Sample

    240805-hl8wzsyhmn

  • MD5

    6065dde59728d97cc4e8a1ea9507ebc0

  • SHA1

    3cd3f35bc129cb824234d3dd91db6c8ef233eed0

  • SHA256

    e0605a1af0015ad5f2133fb81a9bf555efad8d3ad2166845511fcfc797ffa2f2

  • SHA512

    7d02f4cdc5ca622b35ae6eb1fc9610f7d026f498f60d7003e288b9dbdfc0897d435bcc499f98bfdcf5b63a0ab0972f85bd3dd1d659675f86ccfd6281234db5a1

  • SSDEEP

    3072:ce2A0wxDqUpM5scww4chO+O1BmP5DG0sg3i4XZ9WvDZHwdRX/L+gP38XV:csxD5cwohO+O1sVG0/pZ6iPC8

Malware Config

Targets

    • Target

      6065dde59728d97cc4e8a1ea9507ebc0N.exe

    • Size

      326KB

    • MD5

      6065dde59728d97cc4e8a1ea9507ebc0

    • SHA1

      3cd3f35bc129cb824234d3dd91db6c8ef233eed0

    • SHA256

      e0605a1af0015ad5f2133fb81a9bf555efad8d3ad2166845511fcfc797ffa2f2

    • SHA512

      7d02f4cdc5ca622b35ae6eb1fc9610f7d026f498f60d7003e288b9dbdfc0897d435bcc499f98bfdcf5b63a0ab0972f85bd3dd1d659675f86ccfd6281234db5a1

    • SSDEEP

      3072:ce2A0wxDqUpM5scww4chO+O1BmP5DG0sg3i4XZ9WvDZHwdRX/L+gP38XV:csxD5cwohO+O1sVG0/pZ6iPC8

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • ModiLoader Second Stage

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks