Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Lisect_AVT_24003_G1B_24.exe

  • Size

    72.3MB

  • Sample

    240725-c2f81swfmh

  • MD5

    770fa2bd6709f8791f0c8c7d30e0d5c5

  • SHA1

    6d859ffa79a7ce10a405fdc8104b508245d99f0e

  • SHA256

    8e504abe2e1e15b0a2b727dd2b7aef202970bf4b835d03bb8f670df369411efd

  • SHA512

    fa0464af63afa07eb365448b2007fd375ee8daa95eee9795fea658a39aa8dd20766c9626e5f46999006e7a1bc5d1cc4b0dc089c0aed67dd51414999ee9525351

  • SSDEEP

    1572864:kejOS3wsoUMxEpUfuVpWO9cC4LG8UzK+uxoG+YYfeGnkkEgj:k9BUiEPp0C4LGnsX+YYRkkp

Malware Config

Targets

    • Target

      Lisect_AVT_24003_G1B_24.exe

    • Size

      72.3MB

    • MD5

      770fa2bd6709f8791f0c8c7d30e0d5c5

    • SHA1

      6d859ffa79a7ce10a405fdc8104b508245d99f0e

    • SHA256

      8e504abe2e1e15b0a2b727dd2b7aef202970bf4b835d03bb8f670df369411efd

    • SHA512

      fa0464af63afa07eb365448b2007fd375ee8daa95eee9795fea658a39aa8dd20766c9626e5f46999006e7a1bc5d1cc4b0dc089c0aed67dd51414999ee9525351

    • SSDEEP

      1572864:kejOS3wsoUMxEpUfuVpWO9cC4LG8UzK+uxoG+YYfeGnkkEgj:k9BUiEPp0C4LGnsX+YYRkkp

    • Epsilon Stealer

      Information stealer.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.