Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
b1613da97406e039910cecd0327765a2c6477057c9ea8197e967c2fddcb7af6a.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b1613da97406e039910cecd0327765a2c6477057c9ea8197e967c2fddcb7af6a.exe
Resource
win10v2004-20241007-en
General
-
Target
b1613da97406e039910cecd0327765a2c6477057c9ea8197e967c2fddcb7af6a
-
Size
189KB
-
MD5
d5278c37d49c8ca62cb176ca9e4576cd
-
SHA1
08a57c20629cad29627a359c4fa95349b13a45c6
-
SHA256
b1613da97406e039910cecd0327765a2c6477057c9ea8197e967c2fddcb7af6a
-
SHA512
0613e92badda53794c29a32324c784010d7369c9b8bd0fe285c5d94329e1386cc1dc7ee4a2a5e55665a0719929220ed72b93418e01e72117ce91b05972ca51c6
-
SSDEEP
3072:oOhIx7MZiEtR3YDflmocZxr9wUdNx5Q6Saw:rIx7Oiq9YDdzcvr6i1
Malware Config
Extracted
vidar
8.6
5739ef2bbcd39fcd59c5746bfe4238c5
https://steamcommunity.com/profiles/76561199658817715
https://t.me/sa9ok
-
profile_id_v2
5739ef2bbcd39fcd59c5746bfe4238c5
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Signatures
Files
-
b1613da97406e039910cecd0327765a2c6477057c9ea8197e967c2fddcb7af6a.exe windows:5 windows x86 arch:x86
b84c7996282772ebe102e7ab56ad446c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_EH_prolog
strlen
memcmp
__CxxFrameHandler3
strncpy
malloc
_wtoi64
atexit
??_V@YAXPAX@Z
memmove
memchr
strtok_s
strcpy_s
strchr
memcpy
??_U@YAPAXI@Z
memset
kernel32
IsProcessorFeaturePresent
GetCurrentProcess
LocalAlloc
ReadProcessMemory
VirtualQueryEx
OpenProcess
FileTimeToSystemTime
CloseHandle
WaitForSingleObject
CreateThread
GetDriveTypeA
GetLogicalDriveStringsA
GetProcAddress
LoadLibraryA
HeapAlloc
ExitProcess
DecodePointer
LoadLibraryW
GetStringTypeW
MultiByteToWideChar
LCMapStringW
WideCharToMultiByte
GetModuleFileNameW
GetStdHandle
WriteFile
Sleep
RaiseException
EncodePointer
GetLastError
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsSetValue
GetModuleHandleW
SetLastError
GetCurrentThreadId
user32
CharToOemA
advapi32
RegOpenKeyExA
RegGetValueA
GetCurrentHwProfileA
ole32
CoInitializeSecurity
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance
oleaut32
VariantClear
SysAllocString
SysFreeString
VariantInit
shlwapi
ord155
Sections
.text Size: 121KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ