Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    file_x64x86.rar

  • Size

    10.5MB

  • Sample

    240314-qsf4jsfd42

  • MD5

    c0e2e876025cff704f44762e4eef46df

  • SHA1

    53cfde674e868429276dca6c9c4e783ff98b9a8f

  • SHA256

    ce143c9fbf5934660cd61c63796aa00759b07ea5d65b66cd2c05e85239781ad8

  • SHA512

    3c1a3ff3c74b16e1e2c3199f27770ec11fb92d7c2718ee2b0cccbb2c03e8017f3b41ca1d3c08ce03c0e5b594a361de920f7ab08d5722e07e8555c2908c76a694

  • SSDEEP

    196608:XSbIWDiYJg1Z3mG//s6tgqRHqCo7eE8Aj5hjeeEit7w8AmxaPcaY9fTE:WTiYe1Z3ms06tg8H5OC8Gp/Y54

Malware Config

Extracted

Family

risepro

C2

193.233.132.74:50500

Extracted

Family

vidar

Version

8.3

Botnet

bb37828d665bba566345f9103d47fb2b

C2

https://steamcommunity.com/profiles/76561199651834633

https://t.me/raf6ik

Attributes
  • profile_id_v2

    bb37828d665bba566345f9103d47fb2b

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0

Extracted

Family

vidar

Version

8.3

Botnet

0ec692ca895b5b64eae7b06fc17c432d

C2

https://steamcommunity.com/profiles/76561199651834633

https://t.me/raf6ik

Attributes
  • profile_id_v2

    0ec692ca895b5b64eae7b06fc17c432d

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Extracted

Family

smokeloader

Botnet

pub3

Extracted

Family

stealc

C2

http://185.172.128.210

Attributes
  • url_path

    /f993692117a3fda2.php

Targets

    • Target

      file_x64x86.rar

    • Size

      10.5MB

    • MD5

      c0e2e876025cff704f44762e4eef46df

    • SHA1

      53cfde674e868429276dca6c9c4e783ff98b9a8f

    • SHA256

      ce143c9fbf5934660cd61c63796aa00759b07ea5d65b66cd2c05e85239781ad8

    • SHA512

      3c1a3ff3c74b16e1e2c3199f27770ec11fb92d7c2718ee2b0cccbb2c03e8017f3b41ca1d3c08ce03c0e5b594a361de920f7ab08d5722e07e8555c2908c76a694

    • SSDEEP

      196608:XSbIWDiYJg1Z3mG//s6tgqRHqCo7eE8Aj5hjeeEit7w8AmxaPcaY9fTE:WTiYe1Z3ms06tg8H5OC8Gp/Y54

    • Detect Vidar Stealer

    • Detect ZGRat V1

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

    • Glupteba payload

    • RisePro

      RisePro stealer is an infostealer distributed by PrivateLoader.

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

    • Stealc

      Stealc is an infostealer written in C++.

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

    • ZGRat

      ZGRat is remote access trojan written in C#.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Creates new service(s)

    • Downloads MZ/PE file

    • Modifies Windows Firewall

    • Stops running service(s)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Checks whether UAC is enabled

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks