Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    krnl.7z

  • Size

    9.6MB

  • MD5

    5490f7ea67121b425538f55ee546205e

  • SHA1

    8bee391b0f0c63108a0905829cf3b4a2fbdd09a9

  • SHA256

    8e1e6f953e622629b47b58b69c16ebcc34e5bf9a3705c95e1c70faca8f8041f9

  • SHA512

    6c9fe892a513928cf364c0aafa7332bac0c55679e8f8b47c2612df498e41e7379c2945a2b82df2cb67e14bb4a362f854cd9d52f09ef3c250eb2b106d99cada7c

  • SSDEEP

    196608:LGxksCq6EhU6I2Zas+uBFLVvuGNUNymk3J25Y98Mfo5yx7R3tZQL03gt:SWsC5ELay9uiL3YebwkR+

Score
3/10

Malware Config

Signatures

  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

Files

  • krnl.7z
    .zip
  • CloudyApis.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • bin/Cloudy.dll
    .dll windows:6 windows x64 arch:x64

    0231f2cd7096dade3f8ad1fd8830b3c6


    Headers

    Imports

    Exports

    Sections

  • bin/libcrypto-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    680b5c239d82da8e527bf24b921948fd


    Headers

    Imports

    Exports

    Sections

  • bin/libssl-3-x64.dll
    .dll windows:6 windows x64 arch:x64

    b14ebe784f458189a17382fee793f658


    Headers

    Imports

    Exports

    Sections

  • bin/xxhash.dll
    .dll windows:6 windows x64 arch:x64

    fba6b233846a2ea5e6907e23b2de9a26


    Headers

    Imports

    Exports

    Sections

  • bin/zstd.dll
    .dll windows:6 windows x64 arch:x64

    f32e8587cacdf9095c309b87f2877ebb


    Headers

    Imports

    Exports

    Sections

  • krnl.deps.json
  • krnl.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • krnl.exe
    .exe windows:6 windows x64 arch:x64

    6a91eb82bfd19d2706c7d43c46f7064e


    Headers

    Imports

    Sections

  • krnl.pdb
  • krnl.runtimeconfig.json
  • workspace/IY_FE.iy
  • workspace/Rayfield/Configurations/UC.rfld
  • workspace/Rayfield/Discord Invites/usercreated.rfld
  • workspace/Rayfield/settings.rfld