Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
filw.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
filw.exe
Resource
win10v2004-20250207-en
General
-
Target
filw.exe
-
Size
6.1MB
-
MD5
a5dc5dfb3d20c67a35c1ee67e010fc7b
-
SHA1
94694b8cf4d9558014f78037e1fd6fcfe4ddd4e3
-
SHA256
1d810a842c4a71e7490f0a88bb9b0d3c82b084147e73fb2e4ef3c32456055d04
-
SHA512
e8c552eff3537974ef552cf500f7c1060c5bff409fdc8ff34f98544f27afa86fb15edd0930a3b9a699977c452c2115697354772d1b4e0f095744cf7491cc9a48
-
SSDEEP
196608:RaiSkSIlLTUcwti7TQl2NgVg01MWAXAkuujCPX9YG9he5GnQCAJKN:QkSopwtQQl2aOtXADu8X9Y95GQLJ
Malware Config
Extracted
stealerium
https://api.telegram.org/bot7043342993:AAH3tTE7nerxLSr5-SkYKVrmJwCoBBaGRCU/sendMessage?chat_id=
-
url
https://szurubooru.zulipchat.com/api/v1/messages
Signatures
-
Stealerium family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource filw.exe
Files
-
filw.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ