Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    d1de87bc5bee4f8596a7701f52102cbb932199330c00e0bda50307e9a5d66be5.exe

  • Size

    1.7MB

  • Sample

    240824-bxnlvszhnr

  • MD5

    b390074fcd114b194e2ea914536d88fa

  • SHA1

    459827a806caf548e6690332465972337b6e1ff9

  • SHA256

    d1de87bc5bee4f8596a7701f52102cbb932199330c00e0bda50307e9a5d66be5

  • SHA512

    4ecb23ca2b2aaf485fde01d814bfe1354642f3d96cb36548bbcff5618563c8acc432ce1a6fa06e65f322db40c752b8302b56449d943913342c32cbeb7162fc8e

  • SSDEEP

    24576:+SCBdVfI75GMB9YY0DTTILCzwFkEU2UcBJcqC34dKKps013DQFnEAdsFUBvX:+RfKlIf8LACkEHUO9CodXs0BDXAdnv

Malware Config

Extracted

Family

stealc

Botnet

leva

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Targets

    • Target

      d1de87bc5bee4f8596a7701f52102cbb932199330c00e0bda50307e9a5d66be5.exe

    • Size

      1.7MB

    • MD5

      b390074fcd114b194e2ea914536d88fa

    • SHA1

      459827a806caf548e6690332465972337b6e1ff9

    • SHA256

      d1de87bc5bee4f8596a7701f52102cbb932199330c00e0bda50307e9a5d66be5

    • SHA512

      4ecb23ca2b2aaf485fde01d814bfe1354642f3d96cb36548bbcff5618563c8acc432ce1a6fa06e65f322db40c752b8302b56449d943913342c32cbeb7162fc8e

    • SSDEEP

      24576:+SCBdVfI75GMB9YY0DTTILCzwFkEU2UcBJcqC34dKKps013DQFnEAdsFUBvX:+RfKlIf8LACkEHUO9CodXs0BDXAdnv

    • Stealc

      Stealc is an infostealer written in C++.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.