Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Particle.exe

  • Size

    18.4MB

  • Sample

    231207-wad45aec24

  • MD5

    5034635dbc641bc6af5cf3f950eb4ca0

  • SHA1

    480ed67e33136f6a7bf329b1b0df6717f958a072

  • SHA256

    e199cd8a6297d6846f6e2a5a3e8e2450c3c6a9138ab18dc098a34a16bb107bb2

  • SHA512

    f54c72f27af038beb00be4395158fec30973893b6a00e4e822cc29ee01df07148c1180fa94d56902288c1f75fdf205dcd5e2841da5151ea4fea789523fa29fc3

  • SSDEEP

    393216:+qPnLFXlrPYgQpDOETgs77fGWg/fxs82vEmiQVFFL2:zPLFXNPRQoE7tafukEVFJ

Malware Config

Targets

    • Target

      Particle.exe

    • Size

      18.4MB

    • MD5

      5034635dbc641bc6af5cf3f950eb4ca0

    • SHA1

      480ed67e33136f6a7bf329b1b0df6717f958a072

    • SHA256

      e199cd8a6297d6846f6e2a5a3e8e2450c3c6a9138ab18dc098a34a16bb107bb2

    • SHA512

      f54c72f27af038beb00be4395158fec30973893b6a00e4e822cc29ee01df07148c1180fa94d56902288c1f75fdf205dcd5e2841da5151ea4fea789523fa29fc3

    • SSDEEP

      393216:+qPnLFXlrPYgQpDOETgs77fGWg/fxs82vEmiQVFFL2:zPLFXNPRQoE7tafukEVFJ

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks