Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
feb74e768dc8cc7bf98c20ea8f2f23e5c3ffc8e327a41cd21d96bedf10ae7efe
-
Size
1.7MB
-
Sample
240901-rese4atbmc
-
MD5
b0cf5e71ca872709d9445931c2aaad6a
-
SHA1
9793982f71ccab73d3dcc6ae13e76e537823f1c6
-
SHA256
feb74e768dc8cc7bf98c20ea8f2f23e5c3ffc8e327a41cd21d96bedf10ae7efe
-
SHA512
261f63dfcb6458f923cc0a0272a4bf068c83115ee2e838c79cc3055664959abd65413d3bd216b1a47706c39d7bff45d6b1ecf02d2926a65dde2845795d8e58b8
-
SSDEEP
24576:oWMA+zJ7Cze7EbuKEEqlA0kce1dJOyZUR0m5K1O8Uu/4cBWEbR+wiWua5UYdcziP:l+zZCzMLKeljkceYyaiQ8d3BVgYdq0L
Static task
static1
Behavioral task
behavioral1
Sample
feb74e768dc8cc7bf98c20ea8f2f23e5c3ffc8e327a41cd21d96bedf10ae7efe.exe
Resource
win7-20240705-en
Malware Config
Extracted
stealc
leva
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Targets
-
-
Target
feb74e768dc8cc7bf98c20ea8f2f23e5c3ffc8e327a41cd21d96bedf10ae7efe
-
Size
1.7MB
-
MD5
b0cf5e71ca872709d9445931c2aaad6a
-
SHA1
9793982f71ccab73d3dcc6ae13e76e537823f1c6
-
SHA256
feb74e768dc8cc7bf98c20ea8f2f23e5c3ffc8e327a41cd21d96bedf10ae7efe
-
SHA512
261f63dfcb6458f923cc0a0272a4bf068c83115ee2e838c79cc3055664959abd65413d3bd216b1a47706c39d7bff45d6b1ecf02d2926a65dde2845795d8e58b8
-
SSDEEP
24576:oWMA+zJ7Cze7EbuKEEqlA0kce1dJOyZUR0m5K1O8Uu/4cBWEbR+wiWua5UYdcziP:l+zZCzMLKeljkceYyaiQ8d3BVgYdq0L
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-