Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    file

  • Size

    5.9MB

  • Sample

    240313-rfc2ssgd78

  • MD5

    a22002306cbbdc52549b8998a7348cfb

  • SHA1

    6396fa71cd6042d915ec3244eb9eea7b11735b65

  • SHA256

    b29b6f1b6a2d7f6d8b63ac749bdc991892970c7e7643221cf6087d75e4f17c41

  • SHA512

    240cb963bfdf51c25b5284daa49f4fb86539dc6b614327fc5f3f5bf3956784974b7beaefe1df67cdf6e414bb86c2581321f44ec9b58eb25735b7d2e4d6cbd6e6

  • SSDEEP

    98304:3bch/RlekYSHAdakJEnHfCVf4Pp1ScWt/cS4HHQTHYuin7owuTALeZN/sa+gGgH9:3Y5u82J8npxWt/cS4nG47n7t/sGgH8rP

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.145

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Targets

    • Target

      file

    • Size

      5.9MB

    • MD5

      a22002306cbbdc52549b8998a7348cfb

    • SHA1

      6396fa71cd6042d915ec3244eb9eea7b11735b65

    • SHA256

      b29b6f1b6a2d7f6d8b63ac749bdc991892970c7e7643221cf6087d75e4f17c41

    • SHA512

      240cb963bfdf51c25b5284daa49f4fb86539dc6b614327fc5f3f5bf3956784974b7beaefe1df67cdf6e414bb86c2581321f44ec9b58eb25735b7d2e4d6cbd6e6

    • SSDEEP

      98304:3bch/RlekYSHAdakJEnHfCVf4Pp1ScWt/cS4HHQTHYuin7owuTALeZN/sa+gGgH9:3Y5u82J8npxWt/cS4nG47n7t/sGgH8rP

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • Stealc

      Stealc is an infostealer written in C++.

    • Windows security bypass

    • Downloads MZ/PE file

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Manipulates WinMonFS driver.

      Roottkits write to WinMonFS to hide directories/files from being detected.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks