Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
6a3d7bcaf7fcd1ce511dea3e3eaafcf425d1c98c2c6d3e94b6b5bb66bab866f1.exe
-
Size
1.8MB
-
Sample
240928-bvdnwasbng
-
MD5
36cb6ec78aa8cd0a33dfb06d03a0a389
-
SHA1
42cc15ec861309afa84e627e563d251da1afc4c4
-
SHA256
6a3d7bcaf7fcd1ce511dea3e3eaafcf425d1c98c2c6d3e94b6b5bb66bab866f1
-
SHA512
f0e7be775cec5fc9710de71652fe48a3c70103e75d30868465cc47c73740fb6b163c5943e8cec4ff091e17c5d7ff7b5d682d245a58d02894d87e4fb1dd7f305b
-
SSDEEP
49152:m8ZF3q43USo4eI5+louuCkIbceV6+PDFl83sUiitG75txsNa:/q4EFpuCkQxZbFS8Xit++Na
Static task
static1
Behavioral task
behavioral1
Sample
6a3d7bcaf7fcd1ce511dea3e3eaafcf425d1c98c2c6d3e94b6b5bb66bab866f1.exe
Resource
win7-20240704-en
Malware Config
Extracted
stealc
save
http://185.215.113.37
-
url_path
/e2b1563c6670f193.php
Targets
-
-
Target
6a3d7bcaf7fcd1ce511dea3e3eaafcf425d1c98c2c6d3e94b6b5bb66bab866f1.exe
-
Size
1.8MB
-
MD5
36cb6ec78aa8cd0a33dfb06d03a0a389
-
SHA1
42cc15ec861309afa84e627e563d251da1afc4c4
-
SHA256
6a3d7bcaf7fcd1ce511dea3e3eaafcf425d1c98c2c6d3e94b6b5bb66bab866f1
-
SHA512
f0e7be775cec5fc9710de71652fe48a3c70103e75d30868465cc47c73740fb6b163c5943e8cec4ff091e17c5d7ff7b5d682d245a58d02894d87e4fb1dd7f305b
-
SSDEEP
49152:m8ZF3q43USo4eI5+louuCkIbceV6+PDFl83sUiitG75txsNa:/q4EFpuCkQxZbFS8Xit++Na
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-