Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    SecuriteInfo.com.Trojan.PackedNET.2431.12186.10153

  • Size

    943KB

  • Sample

    231006-kjhywsaa9s

  • MD5

    f8db9ff5bdcf53ae061463e8663a9219

  • SHA1

    3c7e2872408ce2b1dea988843543024a44a7d1c9

  • SHA256

    50644de70b66f0785381df5f875b3de0f5a3d13e9eb2798cebcb23bb0ebab385

  • SHA512

    2b1208c9673027d13a8e29d9fe8731676c07275fb8e4360fe573f4d726a7063fbdffee046b97a7b28a0537472dbcfc5c1d2d92cf837d958293258721e348b41e

  • SSDEEP

    12288:3iMq/jOzDsy86GT/KhUzgZiQAi3C9tDNf98fpIE4S+yHHM05QM:ALOojTsUBQAs0A4JynMqQ

Score
7/10

Malware Config

Targets

    • Target

      SecuriteInfo.com.Trojan.PackedNET.2431.12186.10153

    • Size

      943KB

    • MD5

      f8db9ff5bdcf53ae061463e8663a9219

    • SHA1

      3c7e2872408ce2b1dea988843543024a44a7d1c9

    • SHA256

      50644de70b66f0785381df5f875b3de0f5a3d13e9eb2798cebcb23bb0ebab385

    • SHA512

      2b1208c9673027d13a8e29d9fe8731676c07275fb8e4360fe573f4d726a7063fbdffee046b97a7b28a0537472dbcfc5c1d2d92cf837d958293258721e348b41e

    • SSDEEP

      12288:3iMq/jOzDsy86GT/KhUzgZiQAi3C9tDNf98fpIE4S+yHHM05QM:ALOojTsUBQAs0A4JynMqQ

    Score
    7/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks