Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

6a63f64e8b...cN.exe

windows7-x64

10

6a63f64e8b...cN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6a63f64e8b12ec995174b4edf2227b277d23f03268e2577a9a265e619d57918cN.exe

  • Size

    1.3MB

  • Sample

    250207-1dq1bayngw

  • MD5

    5ebe0d1a87ffbb0c5da46fd27afa55c0

  • SHA1

    efb6dd7c8971200b5babfef27e9fd2694309e14b

  • SHA256

    6a63f64e8b12ec995174b4edf2227b277d23f03268e2577a9a265e619d57918c

  • SHA512

    4840de14c11680af2c77e35329cb4807ac55f39f2affd60f8590ee938aa8eaf5a5cc4c635fe58cbd80e3df37e1da5c6f606d4ea4f0a9fd63ef639a3e2e91fff7

  • SSDEEP

    24576:lJQpfDVc5/wP8gvnbxPaCcCu001guRuUk7cmrojzK02+58xBRysw0i9gnK:lyDVkgvbxPkCu001gucUqcm8jm02GImt

Score
10/10
njratdefense_evasiondiscoverytrojan

Malware Config

Targets

    • Target

      6a63f64e8b12ec995174b4edf2227b277d23f03268e2577a9a265e619d57918cN.exe

    • Size

      1.3MB

    • MD5

      5ebe0d1a87ffbb0c5da46fd27afa55c0

    • SHA1

      efb6dd7c8971200b5babfef27e9fd2694309e14b

    • SHA256

      6a63f64e8b12ec995174b4edf2227b277d23f03268e2577a9a265e619d57918c

    • SHA512

      4840de14c11680af2c77e35329cb4807ac55f39f2affd60f8590ee938aa8eaf5a5cc4c635fe58cbd80e3df37e1da5c6f606d4ea4f0a9fd63ef639a3e2e91fff7

    • SSDEEP

      24576:lJQpfDVc5/wP8gvnbxPaCcCu001guRuUk7cmrojzK02+58xBRysw0i9gnK:lyDVkgvbxPkCu001gucUqcm8jm02GImt

    Score
    10/10
    njratdefense_evasiondiscoverytrojan

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      defense_evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks