Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    startup.dll.exe

  • Size

    216KB

  • Sample

    230518-rjcv7sbc71

  • MD5

    33d60a6162d7c6c1f48f96c770ba8dc3

  • SHA1

    6e9e1c3f7d570756e51a95d1add013a70340fd19

  • SHA256

    cfbcaceb818ccb9659325848991f7825d682e790abecc15cf6418d3577f1f0c5

  • SHA512

    ac9b80376166ceea1a612ccecab67ddb0b220003099efeaebcddae7bf96001118611b05263be32ca1cd581765fae920bd7ceae256ea7380cab39e967d5cf7c44

  • SSDEEP

    3072:8wo8lMoohg9X4FmOpS3Td4pDwhDOXG9X7ZOqzm0mDrj0RtP5y:Flp9IFLpSd4pKOsX7ZOwmVDERS

Malware Config

Extracted

Family

smokeloader

Botnet

sprg

Extracted

Family

smokeloader

Version

2022

C2

http://hoh0aeghwugh2gie.com/

http://hie7doodohpae4na.com/

http://aek0aicifaloh1yo.com/

http://yic0oosaeiy7ahng.com/

http://wa5zu7sekai8xeih.com/

rc4.i32
rc4.i32

Extracted

Family

vidar

Version

3.9

Botnet

da3b70a6d41764717ff479f0edd50071

C2

https://steamcommunity.com/profiles/76561199263069598

https://t.me/cybehost

Attributes
  • profile_id_v2

    da3b70a6d41764717ff479f0edd50071

  • user_agent

    Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.7 (like Gecko) (Debian)

Targets

    • Target

      startup.dll.exe

    • Size

      216KB

    • MD5

      33d60a6162d7c6c1f48f96c770ba8dc3

    • SHA1

      6e9e1c3f7d570756e51a95d1add013a70340fd19

    • SHA256

      cfbcaceb818ccb9659325848991f7825d682e790abecc15cf6418d3577f1f0c5

    • SHA512

      ac9b80376166ceea1a612ccecab67ddb0b220003099efeaebcddae7bf96001118611b05263be32ca1cd581765fae920bd7ceae256ea7380cab39e967d5cf7c44

    • SSDEEP

      3072:8wo8lMoohg9X4FmOpS3Td4pDwhDOXG9X7ZOqzm0mDrj0RtP5y:Flp9IFLpSd4pKOsX7ZOwmVDERS

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks