Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
ff38e0f9a9a2980d54e1430b269e9d7751c0c181409426d8391eb898be766000
-
Size
430KB
-
Sample
240328-grlszacd23
-
MD5
bb5c3b9138337d28e4975d34af583e1c
-
SHA1
7ec8f026743edad6b92418bfa1c66950558ff169
-
SHA256
ff38e0f9a9a2980d54e1430b269e9d7751c0c181409426d8391eb898be766000
-
SHA512
932d06eabed378f0b92c052765eef265424a676339107497999d41e6a641703b7877d3204db30dc9b83dd24e570f371684a9b89af73b3cd9737e13e5945429bc
-
SSDEEP
6144:WA9Kay5V+iwqNJ8wH8COxLW10sHtiUh0CrvWqI3CjAD9Ro1:N9KaMV4qL8mlEW1BHAdCDWqsxa1
Static task
static1
Behavioral task
behavioral1
Sample
ff38e0f9a9a2980d54e1430b269e9d7751c0c181409426d8391eb898be766000.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
stealc
http://185.172.128.209
-
url_path
/3cd2b41cbde8fc9c.php
Targets
-
-
Target
ff38e0f9a9a2980d54e1430b269e9d7751c0c181409426d8391eb898be766000
-
Size
430KB
-
MD5
bb5c3b9138337d28e4975d34af583e1c
-
SHA1
7ec8f026743edad6b92418bfa1c66950558ff169
-
SHA256
ff38e0f9a9a2980d54e1430b269e9d7751c0c181409426d8391eb898be766000
-
SHA512
932d06eabed378f0b92c052765eef265424a676339107497999d41e6a641703b7877d3204db30dc9b83dd24e570f371684a9b89af73b3cd9737e13e5945429bc
-
SSDEEP
6144:WA9Kay5V+iwqNJ8wH8COxLW10sHtiUh0CrvWqI3CjAD9Ro1:N9KaMV4qL8mlEW1BHAdCDWqsxa1
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-