Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

winprofile

windows7-x64

3

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    53bab521e261f13706ab05fa6820ef5a7e5e446c1bbdc7ff3a0b0f79349bdbf0

  • Size

    610KB

  • Sample

    220925-17hk2agce5

  • MD5

    1813103203337607b90a3a1e82147667

  • SHA1

    7b3273e539dd8eb6e5f432bbe760b864c6e39257

  • SHA256

    53bab521e261f13706ab05fa6820ef5a7e5e446c1bbdc7ff3a0b0f79349bdbf0

  • SHA512

    738a691218edd74c597a51855fb40e32cdf28ae28b86253076007109b2de89a394c927cf99e3da8cb3e632a81b05d861b93b5f2459a389f36d6390fe56216799

  • SSDEEP

    6144:F2baYZtolbaLl36GRWKbSmM41lhMrTVT5Hv3Shd6yPLNfMDgquK96iF1UcFnVOws:FmzaNzUQS5

Score
10/10
dcratinfostealerratspywarestealer

Malware Config

Targets

    • Target

      53bab521e261f13706ab05fa6820ef5a7e5e446c1bbdc7ff3a0b0f79349bdbf0

    • Size

      610KB

    • MD5

      1813103203337607b90a3a1e82147667

    • SHA1

      7b3273e539dd8eb6e5f432bbe760b864c6e39257

    • SHA256

      53bab521e261f13706ab05fa6820ef5a7e5e446c1bbdc7ff3a0b0f79349bdbf0

    • SHA512

      738a691218edd74c597a51855fb40e32cdf28ae28b86253076007109b2de89a394c927cf99e3da8cb3e632a81b05d861b93b5f2459a389f36d6390fe56216799

    • SSDEEP

      6144:F2baYZtolbaLl36GRWKbSmM41lhMrTVT5Hv3Shd6yPLNfMDgquK96iF1UcFnVOws:FmzaNzUQS5

    Score
    10/10
    dcratinfostealerratspywarestealer

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks