Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Foreign Payment swift_pdf.js

  • Size

    342KB

  • Sample

    221017-qvp48sbhf2

  • MD5

    4e474a544aa97316f1f1ddf56e9c5c70

  • SHA1

    b9775c6cf7a5c6c74b8d9ed1776d35a5a1d8f494

  • SHA256

    46af67f4a2a2c3d7bc6d8743941718c5abd1f3cacb0dd08f9a4c24651a843752

  • SHA512

    4ba58f40318d2582c43e84acb993bb8e9684a3b3955e771043e0742e309020e5482b6aeb5d437dea6c4ecd31ffcf9d6df8693b268c5ac187ba866c4f04d2fbaa

  • SSDEEP

    6144:q8OjK5gRBwhZ2FlbDsmxSvODgTEqEqSMa7Z3tFuQilEI64OHdlG:buKJUlHLxSWDyREqSMstFclEz37G

Malware Config

Extracted

Family

formbook

Campaign

xrob

Decoy

dV8FCtdWdnfMJ9thh8l/

IJG6Bh4iMeHVBHNp2MrpTA==

NhPKKtmQxnHYF/80

f4M2RhGEf3Ot13+qLrKqxb9f3dXj9Q==

A/689/MibSRBgkPkx07m+H+g

e8OOkUu9y/uYCMsdrR3s0mODmGw3d8t9Og==

gLN5bn+Zq1VQXmOOvw==

NFcQGvViY5sxmkty83Fde4GQhg==

XWMfFSM3f7GT9w==

Ih6vvqf9R8gDObM=

FGAlLASHlpLaUUKUJIwm9ABQ2Js=

v8R615LDC8iWchwv

m+u3rLUxScgDObM=

jc3eahERf7GT9w==

TYNBVDadkpTF76HeNl/rbwWtLSbyPzM=

j6NQmhWeOi2B

aqJocUfM3v97ryScY6EiSMbVyBak

V7nYOyEZKa2J/KKh5RMhJrbyK/eC/Q==

8zPsAt3ejcgDObM=

Rpe+BrGBzpGa9q8FHKpi

Targets

    • Target

      Foreign Payment swift_pdf.js

    • Size

      342KB

    • MD5

      4e474a544aa97316f1f1ddf56e9c5c70

    • SHA1

      b9775c6cf7a5c6c74b8d9ed1776d35a5a1d8f494

    • SHA256

      46af67f4a2a2c3d7bc6d8743941718c5abd1f3cacb0dd08f9a4c24651a843752

    • SHA512

      4ba58f40318d2582c43e84acb993bb8e9684a3b3955e771043e0742e309020e5482b6aeb5d437dea6c4ecd31ffcf9d6df8693b268c5ac187ba866c4f04d2fbaa

    • SSDEEP

      6144:q8OjK5gRBwhZ2FlbDsmxSvODgTEqEqSMa7Z3tFuQilEI64OHdlG:buKJUlHLxSWDyREqSMstFclEz37G

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Vjw0rm

      Vjw0rm is a remote access trojan written in JavaScript.

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks