Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
d28457af0ac88284f2372fca429e72f34b9a5dc71618ab331e1f96f319de0d37.exe
-
Size
300KB
-
Sample
241204-bbxbwatkcv
-
MD5
5b553bb30549211be9e171688690ebe0
-
SHA1
bcd8c66a959462cfb01cdd00742392cab80f82bb
-
SHA256
d28457af0ac88284f2372fca429e72f34b9a5dc71618ab331e1f96f319de0d37
-
SHA512
40f8a5a5ae30ad7020805faac0ff3f29cd363623f8b18c7e619cfd807ddabd1fbf3a4fa22bdd11749a12d5261c4672c5235acbc2f528dfab44bf8760c0ffefb3
-
SSDEEP
3072:Ue2A0wxDqUpM5scww4chO+O1BmP5DG0sg3i4XZ9WvDZHwdRX/L+gP38Gy:UsxD5cwohO+O1sVG0/pZ6iPC8I
Static task
static1
Behavioral task
behavioral1
Sample
d28457af0ac88284f2372fca429e72f34b9a5dc71618ab331e1f96f319de0d37.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d28457af0ac88284f2372fca429e72f34b9a5dc71618ab331e1f96f319de0d37.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
d28457af0ac88284f2372fca429e72f34b9a5dc71618ab331e1f96f319de0d37.exe
-
Size
300KB
-
MD5
5b553bb30549211be9e171688690ebe0
-
SHA1
bcd8c66a959462cfb01cdd00742392cab80f82bb
-
SHA256
d28457af0ac88284f2372fca429e72f34b9a5dc71618ab331e1f96f319de0d37
-
SHA512
40f8a5a5ae30ad7020805faac0ff3f29cd363623f8b18c7e619cfd807ddabd1fbf3a4fa22bdd11749a12d5261c4672c5235acbc2f528dfab44bf8760c0ffefb3
-
SSDEEP
3072:Ue2A0wxDqUpM5scww4chO+O1BmP5DG0sg3i4XZ9WvDZHwdRX/L+gP38Gy:UsxD5cwohO+O1sVG0/pZ6iPC8I
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-