Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
b698411bdcbb7e6fe71cec5cdc499eda82a55495847221350d29a74ca7937186
-
Size
453KB
-
Sample
241125-bpx6bszqc1
-
MD5
2f3755d4f3c16b679640a95f756ab59a
-
SHA1
8dabe89c3f1e683a33caee3812a1fe15fd1b8c7d
-
SHA256
b698411bdcbb7e6fe71cec5cdc499eda82a55495847221350d29a74ca7937186
-
SHA512
cfcee82d4c5de54b511283e5da2ff530110134ec1907caec3f39f031185be9aa44b512da0e2e6a6816dbb3f85dc9f9f23e409d96fa70b5c49b97cbe9281e8d9c
-
SSDEEP
6144:pBlL/cC95z7t6MRObOjPnEezm7m6mBmtRm+mQsUKCI887/+JUrhoItI8SCjegF5w:PObbazoTFQ99qX9NZQZ3Tha
Static task
static1
Behavioral task
behavioral1
Sample
b698411bdcbb7e6fe71cec5cdc499eda82a55495847221350d29a74ca7937186.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b698411bdcbb7e6fe71cec5cdc499eda82a55495847221350d29a74ca7937186.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/cxapxirycmq.dll
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/cxapxirycmq.dll
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
b698411bdcbb7e6fe71cec5cdc499eda82a55495847221350d29a74ca7937186
-
Size
453KB
-
MD5
2f3755d4f3c16b679640a95f756ab59a
-
SHA1
8dabe89c3f1e683a33caee3812a1fe15fd1b8c7d
-
SHA256
b698411bdcbb7e6fe71cec5cdc499eda82a55495847221350d29a74ca7937186
-
SHA512
cfcee82d4c5de54b511283e5da2ff530110134ec1907caec3f39f031185be9aa44b512da0e2e6a6816dbb3f85dc9f9f23e409d96fa70b5c49b97cbe9281e8d9c
-
SSDEEP
6144:pBlL/cC95z7t6MRObOjPnEezm7m6mBmtRm+mQsUKCI887/+JUrhoItI8SCjegF5w:PObbazoTFQ99qX9NZQZ3Tha
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
AgentTesla payload
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-
-
-
Target
$PLUGINSDIR/cxapxirycmq.dll
-
Size
20KB
-
MD5
f9c99f7e3b80bd0757ccad6a4ee2c795
-
SHA1
e487ee3c5fc3d1e0817a8c5646ed042312a8ad83
-
SHA256
963d2beb680b2f7b490063c3f248ae28fdadec39b0b9542c4b79a48f07bbd907
-
SHA512
c4ed2f2dc2b6d79f3f37433023428bfe7607360e257864e29fab249619e666df5b00542640d89f29ae510f83e514b41eba14fcc3232e9416a0b8e248eb59b01c
-
SSDEEP
384:7ANhp0pWEbbJVpptCxAoNI2M+qjMoejTJ1Yl5Zn:Ghp0cEbbJPp/NQoyJ1Y7Z
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
AgentTesla payload
-
Suspicious use of SetThreadContext
-