Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    0c70db6a9ca76b810f83954cfd531c69d437484d7346c11cb8234e600a1fa2c3.exe

  • Size

    183KB

  • Sample

    231004-rw9eyacd8y

  • MD5

    ae8dfcee1a8c6fad82462f86e2dd2ba8

  • SHA1

    dc7f36c8636e5b2d76b487609ce75744ea8068d9

  • SHA256

    0c70db6a9ca76b810f83954cfd531c69d437484d7346c11cb8234e600a1fa2c3

  • SHA512

    72a7a841e08202f65d9d3a7fc56d2c2410df1f4b0726f7841b084971ffd26417547fe5264b6b0aabd16db3daf4c4d36fe78e474b102398a21835515dd56d4fb1

  • SSDEEP

    3072:kUIKJJeU9IqkH+LGP34oiKerVUzeeDXbwa21DW9ua/aHyvZRDd2iE:kUIKDeUFybwv

Malware Config

Targets

    • Target

      0c70db6a9ca76b810f83954cfd531c69d437484d7346c11cb8234e600a1fa2c3.exe

    • Size

      183KB

    • MD5

      ae8dfcee1a8c6fad82462f86e2dd2ba8

    • SHA1

      dc7f36c8636e5b2d76b487609ce75744ea8068d9

    • SHA256

      0c70db6a9ca76b810f83954cfd531c69d437484d7346c11cb8234e600a1fa2c3

    • SHA512

      72a7a841e08202f65d9d3a7fc56d2c2410df1f4b0726f7841b084971ffd26417547fe5264b6b0aabd16db3daf4c4d36fe78e474b102398a21835515dd56d4fb1

    • SSDEEP

      3072:kUIKJJeU9IqkH+LGP34oiKerVUzeeDXbwa21DW9ua/aHyvZRDd2iE:kUIKDeUFybwv

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks