Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    29c062ee6df61733f00c39c3290c58a33c1eea61b5fbf2a8560b57b5b689440b

  • Size

    3.3MB

  • Sample

    220502-ahdmnsbhaq

  • MD5

    f2b1412c63ab313adbef1d480583ea37

  • SHA1

    d02b5032d725c104b3eafb476dad23f9958755ae

  • SHA256

    29c062ee6df61733f00c39c3290c58a33c1eea61b5fbf2a8560b57b5b689440b

  • SHA512

    2daf692dbbaa6d60a439c86a95e65f2e47d7df2f57a71ccddf0728bd7d481915550996e3f68dffdeaa0ee813206b5b1ef76febcd47f26ad0fde77162c3859df3

Malware Config

Targets

    • Target

      29c062ee6df61733f00c39c3290c58a33c1eea61b5fbf2a8560b57b5b689440b

    • Size

      3.3MB

    • MD5

      f2b1412c63ab313adbef1d480583ea37

    • SHA1

      d02b5032d725c104b3eafb476dad23f9958755ae

    • SHA256

      29c062ee6df61733f00c39c3290c58a33c1eea61b5fbf2a8560b57b5b689440b

    • SHA512

      2daf692dbbaa6d60a439c86a95e65f2e47d7df2f57a71ccddf0728bd7d481915550996e3f68dffdeaa0ee813206b5b1ef76febcd47f26ad0fde77162c3859df3

    • UnicornStealer

      UnicornStealer is a modular infostealer written in C++.

    • Unicorn Stealer Payload

    • Blocklisted process makes network request

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Uses Tor communications

      Malware can proxy its traffic through Tor for more anonymity.

MITRE ATT&CK Enterprise v6

Tasks