Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
8e84c53178f9724d608c00a624e3efa68492d9269949a98eda8d5687c9c5cb36.exe
-
Size
1.7MB
-
Sample
240904-cdy4xsshlp
-
MD5
68542ccb1dbce6ed08f452a53d9d08c0
-
SHA1
edb30c1007a946c76ae51acf3b45918ede16c3e4
-
SHA256
8e84c53178f9724d608c00a624e3efa68492d9269949a98eda8d5687c9c5cb36
-
SHA512
986ca0ee77d3418d0c2e5e80e8ae92eca560c18eb8ecbb4046b3e6c6fd9cf5980c77af860e703289bba0ccd51ed8ca2b2cf51b735b098c06f546123178b6d25c
-
SSDEEP
24576:p0mPX28WP5DdhvW+D4uYBCxHPtHefAD1zLX2dj5IkixLQrYSXhqlARJnQhq:qT8WP5D37t+fYzyFALdAql42
Static task
static1
Behavioral task
behavioral1
Sample
8e84c53178f9724d608c00a624e3efa68492d9269949a98eda8d5687c9c5cb36.exe
Resource
win7-20240903-en
Malware Config
Extracted
stealc
leva
http://185.215.113.100
-
url_path
/e2b1563c6670f193.php
Targets
-
-
Target
8e84c53178f9724d608c00a624e3efa68492d9269949a98eda8d5687c9c5cb36.exe
-
Size
1.7MB
-
MD5
68542ccb1dbce6ed08f452a53d9d08c0
-
SHA1
edb30c1007a946c76ae51acf3b45918ede16c3e4
-
SHA256
8e84c53178f9724d608c00a624e3efa68492d9269949a98eda8d5687c9c5cb36
-
SHA512
986ca0ee77d3418d0c2e5e80e8ae92eca560c18eb8ecbb4046b3e6c6fd9cf5980c77af860e703289bba0ccd51ed8ca2b2cf51b735b098c06f546123178b6d25c
-
SSDEEP
24576:p0mPX28WP5DdhvW+D4uYBCxHPtHefAD1zLX2dj5IkixLQrYSXhqlARJnQhq:qT8WP5D37t+fYzyFALdAql42
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-