Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    saBSI.exe

  • Size

    1.1MB

  • Sample

    240319-l4trkahh9w

  • MD5

    b3e4101a01e2460acded70366749e2d3

  • SHA1

    135e644f2a0b1b2d601bd03b0a358ecc95ad294a

  • SHA256

    e03cf75a6dd922011d0f6b9e2c43a80574334868bc2e9f7ca9be57156647fe03

  • SHA512

    a8d26ad577c7a19267d44f6d4d7204bbd315839be97da3fd8289a7235b9642bd920846fc3cad58bbdb52196cb53902bf6ae0fb497c550566cfdc6834a0026c64

  • SSDEEP

    24576:+xXu1+BvB2CDxXeudf8IKboisG3FZhblJRk5BE7DzJ7P0PJLSUB92Mp9xJ:+K+xB2CDxXTpU3FZhblJRk5anFP0hLSE

Malware Config

Targets

    • Target

      saBSI.exe

    • Size

      1.1MB

    • MD5

      b3e4101a01e2460acded70366749e2d3

    • SHA1

      135e644f2a0b1b2d601bd03b0a358ecc95ad294a

    • SHA256

      e03cf75a6dd922011d0f6b9e2c43a80574334868bc2e9f7ca9be57156647fe03

    • SHA512

      a8d26ad577c7a19267d44f6d4d7204bbd315839be97da3fd8289a7235b9642bd920846fc3cad58bbdb52196cb53902bf6ae0fb497c550566cfdc6834a0026c64

    • SSDEEP

      24576:+xXu1+BvB2CDxXeudf8IKboisG3FZhblJRk5BE7DzJ7P0PJLSUB92Mp9xJ:+K+xB2CDxXTpU3FZhblJRk5anFP0hLSE

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Registers COM server for autorun

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks