Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
15539a353d5b7e18b87b30f717454dc25c4261954d97af791596ea49acb1fa92.zip
-
Size
163KB
-
Sample
230321-r49qnsbe35
-
MD5
380ee44c47caece2322c9495883ac170
-
SHA1
f3c0379358d6333a592c4fef12485f03f130fa49
-
SHA256
1583d884c1cfc6da3574a148912647eb1936a0031c45c9ed05e58d7f138c70a6
-
SHA512
04e1a5914f5b224fbbf4079cb60bf159a02ca3667e3816e845a235f2562c6486cd1208262debfeacdf618fd4122d169d6b870c30fa24c1cd20d7bc7b0e7ddf6f
-
SSDEEP
3072:UKfsxdq/aW4YlQpBnQUXtykTZ2C4Il+gvocdLusoVFvjPXZIChkXXA6fliu1zF0K:Ixd+aW/MnQU9VTZ2C/wgnFHof9I0knAW
Static task
static1
Behavioral task
behavioral1
Sample
15539a353d5b7e18b87b30f717454dc25c4261954d97af791596ea49acb1fa92.exe
Resource
win7-20230220-en
Malware Config
Extracted
stealc
http://45.87.154.30
Extracted
laplas
http://45.87.154.105
-
api_key
1c630872d348a77d04368d542fde4663bc2bcb96f1b909554db3472c08df2767
Targets
-
-
Target
15539a353d5b7e18b87b30f717454dc25c4261954d97af791596ea49acb1fa92.exe
-
Size
291KB
-
MD5
8cca6d631010620a368ddc7925c0649c
-
SHA1
cbac7cdb0b393a64a25726c09c718616e83ffa8f
-
SHA256
15539a353d5b7e18b87b30f717454dc25c4261954d97af791596ea49acb1fa92
-
SHA512
4c38a618668d2fe78ee950aaadd4f32d7f4ff3130039efefb1e039bc79aeedb2e065141fdd96d4255735ffb68a991b83e0d4609e02a76a958c99feda4f24135c
-
SSDEEP
3072:2D2H6X9LmnZiTw5aX/ifwSYt3pkki/c9yEh+vp5nbrSLJhCe:MX9LmnMTlX/iYSYPkR/cWvzvohC
-
Detects Stealc stealer
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-