Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Beaming_1.exe

  • Size

    3.8MB

  • Sample

    230314-t9pc2aae9v

  • MD5

    f8f4beee36644a8f1900d444c60095a7

  • SHA1

    ec35d449980bc841da9ac9e05d9e70544b288187

  • SHA256

    4c1edb68278dfcdedc31fe0668e4ab99bb96304f34e986ca88b8e1cfbeeb7458

  • SHA512

    3c8eb4c206707aa4d21e3aecb13509088252ce5320149f3b42fe65a40c7784adcac08055d1a3bcbe4dd91027fd7d3154f7ac56597d3ec330063fe9be69e7cbc6

  • SSDEEP

    49152:8KkxfRMi34wtlCt0MHfgQmikU9EVLMl0OfAVG9vxBID8BH43vZiKz9IjQvk6Bh57:zkxf934wt4mjTxwf54DMpkvj84228

Malware Config

Targets

    • Target

      Beaming_1.exe

    • Size

      3.8MB

    • MD5

      f8f4beee36644a8f1900d444c60095a7

    • SHA1

      ec35d449980bc841da9ac9e05d9e70544b288187

    • SHA256

      4c1edb68278dfcdedc31fe0668e4ab99bb96304f34e986ca88b8e1cfbeeb7458

    • SHA512

      3c8eb4c206707aa4d21e3aecb13509088252ce5320149f3b42fe65a40c7784adcac08055d1a3bcbe4dd91027fd7d3154f7ac56597d3ec330063fe9be69e7cbc6

    • SSDEEP

      49152:8KkxfRMi34wtlCt0MHfgQmikU9EVLMl0OfAVG9vxBID8BH43vZiKz9IjQvk6Bh57:zkxf934wt4mjTxwf54DMpkvj84228

    • StormKitty

      StormKitty is an open source info stealer written in C#.

    • StormKitty payload

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks