Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

INVOICES [...5].exe

windows7-x64

10

INVOICES [...5].exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    INVOICES [W_ID11942885].exe

  • Size

    615KB

  • Sample

    220816-hal8vadeam

  • MD5

    026faaac7d955679f37fbe9aff2b75a4

  • SHA1

    d88d0157953cc9d0ad77cbfefb0f6b7cf8aad214

  • SHA256

    44138f7dab527ee231c6a17b66f24d2568861d22da9c2e7aff1a9a624917300b

  • SHA512

    57ed93bdde36f77cf44d8bfdfbaf17034561fa13d5291be0178745e93237373a6779f015caaa2b8d7bcf58772ac7e2f88a6d04e012af5c5af3917c1f098a2cc9

Score
10/10
blustealerstormkittycollectionstealer

Malware Config

Targets

    • Target

      INVOICES [W_ID11942885].exe

    • Size

      615KB

    • MD5

      026faaac7d955679f37fbe9aff2b75a4

    • SHA1

      d88d0157953cc9d0ad77cbfefb0f6b7cf8aad214

    • SHA256

      44138f7dab527ee231c6a17b66f24d2568861d22da9c2e7aff1a9a624917300b

    • SHA512

      57ed93bdde36f77cf44d8bfdfbaf17034561fa13d5291be0178745e93237373a6779f015caaa2b8d7bcf58772ac7e2f88a6d04e012af5c5af3917c1f098a2cc9

    Score
    10/10
    blustealerstormkittycollectionstealer

    • BluStealer

      A Modular information stealer written in Visual Basic.

      stealerblustealer

    • StormKitty

      StormKitty is an open source info stealer written in C#.

      stealerstormkitty

    • StormKitty payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks