Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
ad2a1ee521d33b206afad5a2dd0d21a2_JaffaCakes118
-
Size
428KB
-
Sample
240820-akjxgaxemm
-
MD5
ad2a1ee521d33b206afad5a2dd0d21a2
-
SHA1
601af70074c026041f081802d67f04142fd4d0a9
-
SHA256
bc33270f7affb342c69f3ac752b73257071e99a3925ccd8e6ae9a289416df437
-
SHA512
e7b5957a74091d3b5c4a6c7b8e955637461d5463c37cb7db160522fa125f9ba90c3508898a0bc598a4a47a8db3b02b4b539f5e9b38fa63eaab300422c85063f0
-
SSDEEP
12288:PRfN6EeArbvKNvjAcpPYIABWt4CROw8ch4:PqnNsWPxhOw/4
Static task
static1
Behavioral task
behavioral1
Sample
PO. pdf.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
PO. pdf.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
lokibot
http://becharnise.ir/fa12/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Targets
-
-
Target
PO. pdf.exe
-
Size
611KB
-
MD5
26d938e936501c40950dddad234a7e25
-
SHA1
3b89ab83aef9bfb294f9a83c774533459fb0f6bb
-
SHA256
3c5b0462854d7115d4e6a6c1e1154ae2bfe6df8245328a6db34d6ebfe77f3e34
-
SHA512
e99aae5469a053eb323abc644751d4a48c226e3b9cdade588f49030b9c7d1e0cb5b0602690d356fc7e1abc54e56e2e417adbdcd77a0a03cbb91400ba165e6e87
-
SSDEEP
12288:CWtN6EcUrLpWLvjwcFPYSABWB4CDODFwrltD:CznLkIPRnODirlt
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-