Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
314da2658394fb6c9d442ae811419fea9ee77692a2fb248e9e1c79257dd234df.exe
Resource
win7-20240729-en
General
-
Target
314da2658394fb6c9d442ae811419fea9ee77692a2fb248e9e1c79257dd234df
-
Size
1.8MB
-
MD5
01a2d5b9240007c8a8cce9d6e8d6532f
-
SHA1
d0d5f8723150397e8e1c3cc6ba90300d75555fdb
-
SHA256
314da2658394fb6c9d442ae811419fea9ee77692a2fb248e9e1c79257dd234df
-
SHA512
450bc3f9634ed37ea2e1f53fa476b1649f26ced042b03c1885237df9dc269e50486abe31379123e8afc3a56c074c2e470fbc9be24d51fc3555c41dee925ecfdd
-
SSDEEP
49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+Agr6SGtgdz:BemTLkNdfE0pZrwO
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
resource yara_rule sample family_kpot -
Kpot family
-
XMRig Miner payload 1 IoCs
resource yara_rule sample xmrig -
Xmrig family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 314da2658394fb6c9d442ae811419fea9ee77692a2fb248e9e1c79257dd234df
Files
-
314da2658394fb6c9d442ae811419fea9ee77692a2fb248e9e1c79257dd234df.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
UPX0 Size: 724KB - Virtual size: 3.0MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 272KB - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE