Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    5212ecaf2c3880d92f371356d84105be.exe

  • Size

    254KB

  • Sample

    240224-3l6rvagg62

  • MD5

    5212ecaf2c3880d92f371356d84105be

  • SHA1

    d17cc3b0083fef207a84eefbb927ac9a79ef01ae

  • SHA256

    cc4cb393dfc2c8fef2d76f297554a93cbec91244fe7ad5dc3ab533018d52fc84

  • SHA512

    a1987d88d57e2a835f81b771da0bd8f8d26800d023d088558a688979bd876a8f142fdfe2b2462907be6401152fc3ec7dd87bae0749e118c9ca82080963253a09

  • SSDEEP

    3072:Gl6mR5pZ1bjBUEzlFJYPBWk8XMF5uaaaETz:+XpZRj2yY5p4RaavT

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://selebration17io.io/index.php

http://vacantion18ffeu.cc/index.php

http://valarioulinity1.net/index.php

http://buriatiarutuhuob.net/index.php

http://cassiosssionunu.me/index.php

http://sulugilioiu19.net/index.php

http://goodfooggooftool.net/index.php

http://kamsmad.com/tmp/index.php

http://souzhensil.ru/tmp/index.php

http://teplokub.com.ua/tmp/index.php

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

stealc

C2

http://185.172.128.145

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Targets

    • Target

      5212ecaf2c3880d92f371356d84105be.exe

    • Size

      254KB

    • MD5

      5212ecaf2c3880d92f371356d84105be

    • SHA1

      d17cc3b0083fef207a84eefbb927ac9a79ef01ae

    • SHA256

      cc4cb393dfc2c8fef2d76f297554a93cbec91244fe7ad5dc3ab533018d52fc84

    • SHA512

      a1987d88d57e2a835f81b771da0bd8f8d26800d023d088558a688979bd876a8f142fdfe2b2462907be6401152fc3ec7dd87bae0749e118c9ca82080963253a09

    • SSDEEP

      3072:Gl6mR5pZ1bjBUEzlFJYPBWk8XMF5uaaaETz:+XpZRj2yY5p4RaavT

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Stealc

      Stealc is an infostealer written in C++.

    • Contacts a large (554) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates new service(s)

    • Downloads MZ/PE file

    • Stops running service(s)

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks