Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
vtoroy.exe
Resource
win7-20241023-en
General
-
Target
vtoroy.exe
-
Size
239KB
-
MD5
1e6930dc9f7e53ffba84c295d8f766ed
-
SHA1
ac716d7c6e2d65ea845f8f2cd4252c82e387577b
-
SHA256
5ec0ca0d40ea0737601710565265bce4fbfed9e813d2ce401e038726e1155746
-
SHA512
ffdc5ed06b0a98d3216aec12ed878929defe5ebd750be9653bf14210bb104d6142bb8b9bafa0f7de5807d1d60d700b8b6f15e005504f76633869a6ae20a16890
-
SSDEEP
3072:rtCrbK4vn4p+U1v+N3Bz1IJ8JEchyka7Z7LU/fJWtMMJ08:paGm1U5Y1ICJU117L+JWOqz
Malware Config
Extracted
stealc
Line
http://154.216.17.90
-
url_path
/a48146f6763ef3af.php
Signatures
-
Stealc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource vtoroy.exe
Files
-
vtoroy.exe.exe windows:5 windows x86 arch:x86
9688495fa0fb07674109d4238c74f5ee
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
rand
strncpy
??_V@YAXPAX@Z
strtok
memchr
strtok_s
??_U@YAPAXI@Z
strcpy_s
vsprintf_s
memmove
strlen
malloc
free
memcmp
??2@YAPAXI@Z
memset
memcpy
__CxxFrameHandler3
_except_handler3
kernel32
GetModuleFileNameW
GetStringTypeW
MultiByteToWideChar
LCMapStringW
lstrlenA
HeapAlloc
GetProcessHeap
VirtualProtect
CreateProcessA
lstrcatA
VirtualQueryEx
OpenProcess
ReadProcessMemory
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
DecodePointer
TerminateProcess
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
RtlUnwind
GetProcAddress
GetModuleHandleW
ExitProcess
Sleep
WriteFile
GetStdHandle
GetLastError
LoadLibraryW
TlsGetValue
TlsSetValue
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
WideCharToMultiByte
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RaiseException
Sections
.text Size: 166KB - Virtual size: 165KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ