Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Avernus.zip

  • Size

    23.8MB

  • MD5

    4caa96433e32bc6e75520eee388a38eb

  • SHA1

    991e1a7c5f59f4707410889b849ff078a704aefa

  • SHA256

    4b60b2960da8862d8ddb07ca1a96302bc591110dc1898a0bc6495e4fbacd56ad

  • SHA512

    662cac6844f44f58f7dea59fe543f7a0e45379ab9b529c8d9e871b7a98bd15cf799b2b1cdc1ea862017975fbc1b0194264f25c5ad3d175a4105e67f07fb2fbf2

  • SSDEEP

    393216:jRUkeH++Ar8g75a9rqf+Yg+0lI0sU9GEtDgF9S3SG0U87MCZFt8Sxsxv4yrm:VUpmla9vk0+klgF7s8YwFWSKv6

Score
10/10

Malware Config

Signatures

  • A stealer written in Python and packaged with Pyinstaller 2 IoCs
  • Blankgrabber family
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

Files

  • Avernus.zip
    .zip
  • Avernus/Avernus/Avernus.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • Avernus/Avernus/DLLJector.zip
    .zip
  • DLL/Built.exe
    .exe windows:6 windows x64 arch:x64

    72c4e339b7af8ab1ed2eb3821c98713a


    Code Sign

    Headers

    Imports

    Sections

  • J�8w7��.pyc
  • Avernus/Avernus/DLLJector/AvernusInjector.exe.lnk
    .lnk
  • Avernus/Avernus/DLLJector/DLL/AvernusInjector.exe
    .exe windows:6 windows x64 arch:x64

    72c4e339b7af8ab1ed2eb3821c98713a


    Code Sign

    Headers

    Imports

    Sections

  • J�8w7��.pyc
  • Avernus/Avernus/ForlornApi.dll
    .dll windows:4 windows x64 arch:x64


    Headers

    Sections

  • Avernus/Avernus/ForlornInject.dll
    .dll windows:6 windows x64 arch:x64

    22f1907af71b391673dc37c47e7cfa75


    Headers

    Imports

    Exports

    Sections

  • Avernus/Avernus/bin/ForlornInject.dll
    .dll windows:6 windows x64 arch:x64

    ac435dfa812fddee99bbf7a986186d1d


    Headers

    Imports

    Exports

    Sections

  • Avernus/Avernus/bin/libcrypto-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    680b5c239d82da8e527bf24b921948fd


    Headers

    Imports

    Exports

    Sections

  • Avernus/Avernus/bin/libssl-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    1dedd757946c1ca3c32f97146f7a6c25


    Headers

    Imports

    Exports

    Sections

  • Avernus/Avernus/bin/xxhash.dll
    .dll windows:6 windows x64 arch:x64

    fba6b233846a2ea5e6907e23b2de9a26


    Headers

    Imports

    Exports

    Sections

  • Avernus/Avernus/bin/zstd.dll
    .dll windows:6 windows x64 arch:x64

    f32e8587cacdf9095c309b87f2877ebb


    Headers

    Imports

    Exports

    Sections

  • Avernus/Avernus/workspace/.tests/appendfile.txt
  • Avernus/Avernus/workspace/.tests/getcustomasset.txt
  • Avernus/Avernus/workspace/.tests/isfile.txt
  • Avernus/Avernus/workspace/.tests/listfiles/test_1.txt
  • Avernus/Avernus/workspace/.tests/listfiles/test_2.txt
  • Avernus/Avernus/workspace/.tests/loadfile.txt
  • Avernus/Avernus/workspace/.tests/readfile.txt
  • Avernus/Avernus/workspace/.tests/writefile
  • Avernus/Avernus/workspace/.tests/writefile.txt
  • Avernus/Avernus/workspace/648