Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Doctors_Recommendation.zip

  • Size

    603KB

  • Sample

    231113-kmdhksbf3v

  • MD5

    2722ac5995ef1c70737e9c93cb126420

  • SHA1

    b192674028e90a65be27972a1db508ca3498315e

  • SHA256

    56c0ad75e6cc54a04effb02343d0dcb04e2b14547eef80a20e918cd2bcfe82cb

  • SHA512

    22b662c1b7a372330821cb28a5ffa1753636198f4caa3e8cbc00e1cb40144716581ec55d386283e4f2fac9cecf1eeb4a7e75aa233d7764eed9ad06c8289cedf7

  • SSDEEP

    12288:9DWxqmjLYP85JObg3mPYt67M8K5PT8gd9xRfueNP44UKUt4teZyaa7:0x5sP85JnWAg7MNp7h0C44TU3yn7

Malware Config

Targets

    • Target

      Doctors_Recommendation.scr

    • Size

      3.0MB

    • MD5

      c9bf7a5c92aef719f5f04eb70898b443

    • SHA1

      b2dc4cda58699708a4ebfd31d2a7f5828718f1bc

    • SHA256

      81dbad520f8f4d8163e02d7b01866918e8392bb549df2cb73f1b8148f6fd5b51

    • SHA512

      0ff25c1c2938862018b3f995bfe1e699507b02046ba1592538f02b4b497a6165a8fa8f3fb7531faf908f0fc72f8c02ac034961bfb94fe5365ae636912ac5ad9a

    • SSDEEP

      24576:Ku9FGdK/Ho7S+P6/i1iJq3TXC92REo4Q7hvgL:KZdKOS8sw8GRESFK

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks