Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    COA - SHIPPING DETAILS.exe

  • Size

    947KB

  • Sample

    230616-zterjsgc9z

  • MD5

    bb1ce76571f48fc3f8b46eb7190de98c

  • SHA1

    f3d2d2b5d9e5d3cc4b3a9f14e868b5fd52701096

  • SHA256

    79c480e4e624e767affddfda25ca5b454505dcf79f1c772f604e2a9e649fc69e

  • SHA512

    d1608ebe6494c6de47f74f39bdc445197e2b3875793b53709389fb4292907466fdd020357c4fa90655d6a2c67ed5b204499971b90196a6be61798ba5f177b352

  • SSDEEP

    24576:wT1kbCJN5gd5pI82SYxVSEIZBm4M725AavgV+wBXLYY9cUb:wTebqN5gdzXAVSE0Bc1UweOjb

Malware Config

Extracted

Family

azorult

C2

http://dblxs.shop/Bll1/index.php

Targets

    • Target

      COA - SHIPPING DETAILS.exe

    • Size

      947KB

    • MD5

      bb1ce76571f48fc3f8b46eb7190de98c

    • SHA1

      f3d2d2b5d9e5d3cc4b3a9f14e868b5fd52701096

    • SHA256

      79c480e4e624e767affddfda25ca5b454505dcf79f1c772f604e2a9e649fc69e

    • SHA512

      d1608ebe6494c6de47f74f39bdc445197e2b3875793b53709389fb4292907466fdd020357c4fa90655d6a2c67ed5b204499971b90196a6be61798ba5f177b352

    • SSDEEP

      24576:wT1kbCJN5gd5pI82SYxVSEIZBm4M725AavgV+wBXLYY9cUb:wTebqN5gdzXAVSE0Bc1UweOjb

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks