Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

ZoomFull.exe

windows7-x64

10

ZoomFull.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ZoomFull.exe

  • Size

    109.2MB

  • Sample

    250312-mr23vaxycy

  • MD5

    35a45131142cb3baebc149aeb9e334bd

  • SHA1

    5089f9f7d858af435b86fff90e3619c6cf00f2d0

  • SHA256

    b37a0a7ff6ad23dc71339f86ffa4223327dfcb015d24c32e74cf4ac8a272d1a8

  • SHA512

    31943ce86643d230477c6ba3a7790793af0ff7a436e3ca8bf016639cd31708d969e8283f07cc84e3eceae802a0f9c15ceaa40ec2297c30ad5e5faaf93b6d2522

  • SSDEEP

    3145728:vfmQMvAksxzchxtPdMULP51V5wlRRPUSWvAqk:Xmaks1WxPMULP5b+RRPKAqk

Score
10/10
rhadamanthysdefense_evasiondiscoveryprivilege_escalationstealer

Malware Config

Targets

    • Target

      ZoomFull.exe

    • Size

      109.2MB

    • MD5

      35a45131142cb3baebc149aeb9e334bd

    • SHA1

      5089f9f7d858af435b86fff90e3619c6cf00f2d0

    • SHA256

      b37a0a7ff6ad23dc71339f86ffa4223327dfcb015d24c32e74cf4ac8a272d1a8

    • SHA512

      31943ce86643d230477c6ba3a7790793af0ff7a436e3ca8bf016639cd31708d969e8283f07cc84e3eceae802a0f9c15ceaa40ec2297c30ad5e5faaf93b6d2522

    • SSDEEP

      3145728:vfmQMvAksxzchxtPdMULP51V5wlRRPUSWvAqk:Xmaks1WxPMULP5b+RRPKAqk

    Score
    10/10
    rhadamanthysdiscoverystealerdefense_evasionprivilege_escalation

    • Detects Rhadamanthys payload

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

      stealerrhadamanthys

    • Rhadamanthys family

      rhadamanthys

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks