Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    NotARat.exe

  • Size

    37.6MB

  • Sample

    240626-pxr6yavdnd

  • MD5

    c08c75f727168728b6f209fc4ec1a11d

  • SHA1

    8d0e836fd93861097b98aa859564dacaac50b6fd

  • SHA256

    2bef68392f825f8100b9b43ba618339786681a830f8e7729c60199b77a0c1d08

  • SHA512

    71e909331412a7fdfad7e986bd1a9e150f9e012c5e12da0b1ee49b7f2c120fbba0dd7353b92150f9e83ff96c435333505f065ed7ff88e91f203869a8e90c93c0

  • SSDEEP

    786432:R3on1HvSzxAMNmFZArYs0LZ3WLaTyicgQ:RYn1HvSpNmXm0FjTyLgQ

Malware Config

Targets

    • Target

      NotARat.exe

    • Size

      37.6MB

    • MD5

      c08c75f727168728b6f209fc4ec1a11d

    • SHA1

      8d0e836fd93861097b98aa859564dacaac50b6fd

    • SHA256

      2bef68392f825f8100b9b43ba618339786681a830f8e7729c60199b77a0c1d08

    • SHA512

      71e909331412a7fdfad7e986bd1a9e150f9e012c5e12da0b1ee49b7f2c120fbba0dd7353b92150f9e83ff96c435333505f065ed7ff88e91f203869a8e90c93c0

    • SSDEEP

      786432:R3on1HvSzxAMNmFZArYs0LZ3WLaTyicgQ:RYn1HvSpNmXm0FjTyLgQ

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Hide Artifacts: Hidden Window

      Windows that would typically be displayed when an application carries out an operation can be hidden.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • An obfuscated cmd.exe command-line is typically used to evade detection.

MITRE ATT&CK Enterprise v15

Tasks