Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

SecuriteIn...99.exe

windows7-x64

7

SecuriteIn...99.exe

windows10-2004-x64

10

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Win32.SuspectCrc.28951.5999.exe

  • Size

    940KB

  • Sample

    250211-m9wc1swkgt

  • MD5

    ba614b66f0bde2fd7968180a6fe258b3

  • SHA1

    027202eb8184749c031ab9afcc2c062bd83c80a8

  • SHA256

    3f89c7d72378f5fd330247aa261f097da0d1bfefd3d2e19c49aee42ae412f656

  • SHA512

    2652f6093ddc039c99ec12cfe1c0aee0f96efb1e89a4a05a88ad31ef201356c5777a84c61b2b4ff61bfd8bf94774f5b99c230d4da9fa04ca5ca2a7a4610c7c2d

  • SSDEEP

    24576:8s2NlFWrzGtGbXSCMOKbFy4fWmVRpkVoJfCMoU8Z1A:glcrKSCvAAW8lCLU8ZC

Score
10/10
guloaderdiscoverydownloader

Malware Config

Targets

    • Target

      SecuriteInfo.com.Win32.SuspectCrc.28951.5999.exe

    • Size

      940KB

    • MD5

      ba614b66f0bde2fd7968180a6fe258b3

    • SHA1

      027202eb8184749c031ab9afcc2c062bd83c80a8

    • SHA256

      3f89c7d72378f5fd330247aa261f097da0d1bfefd3d2e19c49aee42ae412f656

    • SHA512

      2652f6093ddc039c99ec12cfe1c0aee0f96efb1e89a4a05a88ad31ef201356c5777a84c61b2b4ff61bfd8bf94774f5b99c230d4da9fa04ca5ca2a7a4610c7c2d

    • SSDEEP

      24576:8s2NlFWrzGtGbXSCMOKbFy4fWmVRpkVoJfCMoU8Z1A:glcrKSCvAAW8lCLU8ZC

    Score
    10/10
    discoveryguloaderdownloader

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      b21a3377e66b941df6d5b7cf8ba7a43a

    • SHA1

      e7ed27fce2db9cdc11ca3c640806731dcef3864a

    • SHA256

      ba46a03088f690ce966043f49761ff3a3a0dca236160794de841dfecc3588d1e

    • SHA512

      f011a824c0ff7f87c6da112898f4afc87e12c5b39fb40ffcc0955012e79a4302597d892224b3b47e8143480605c73275d3799d6d2000cdf179c2912241f86916

    • SSDEEP

      48:im1YEhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0Jsof5dwe:F1apl9NLBAZuYtR0/d

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      792b6f86e296d3904285b2bf67ccd7e0

    • SHA1

      966b16f84697552747e0ddd19a4ba8ab5083af31

    • SHA256

      c7a20bcaa0197aedddc8e4797bbb33fdf70d980f5e83c203d148121c2106d917

    • SHA512

      97edc3410b88ca31abc0af0324258d2b59127047810947d0fb5e7e12957db34d206ffd70a0456add3a26b0546643ff0234124b08423c2c9ffe9bdec6eb210f2c

    • SSDEEP

      192:rFiQJ771Jt17C8F1A5xjGNNvgFOiLb7lrT/L93:X71Jt48F2eNvgFF/L

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral5behavioral6

MITRE ATT&CK Enterprise v15

Tasks