Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    ba96f1e9c704df28323c460be3c627b5c638d2bd4fcae869f227121d0dff5d62.msi

  • Size

    34.9MB

  • Sample

    250320-ejlf5axjv3

  • MD5

    9cf0093a76065c3c65c1dfbbb76fa82b

  • SHA1

    98276b30afb00ea041b2b5b922eff7e917b620ea

  • SHA256

    ba96f1e9c704df28323c460be3c627b5c638d2bd4fcae869f227121d0dff5d62

  • SHA512

    b3fd984c03000884c566caf79bc5686078018dc7f79b4919e1fcec0f6dc47cf05136439229aa292a508739f37151fa209546cfa53622416666f4fb2ae17a3c5a

  • SSDEEP

    786432:pCLRK7wXCr4zP7pRv/dpO26Aj1Izj6T6Da9Bm:4LM7Vr4zlJ626A8Na9B

Malware Config

Targets

    • Target

      ba96f1e9c704df28323c460be3c627b5c638d2bd4fcae869f227121d0dff5d62.msi

    • Size

      34.9MB

    • MD5

      9cf0093a76065c3c65c1dfbbb76fa82b

    • SHA1

      98276b30afb00ea041b2b5b922eff7e917b620ea

    • SHA256

      ba96f1e9c704df28323c460be3c627b5c638d2bd4fcae869f227121d0dff5d62

    • SHA512

      b3fd984c03000884c566caf79bc5686078018dc7f79b4919e1fcec0f6dc47cf05136439229aa292a508739f37151fa209546cfa53622416666f4fb2ae17a3c5a

    • SSDEEP

      786432:pCLRK7wXCr4zP7pRv/dpO26Aj1Izj6T6Da9Bm:4LM7Vr4zlJ626A8Na9B

    • Detects Rhadamanthys payload

    • Rhadamanthys

      Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    • Rhadamanthys family

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks