Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    9690eff3fd51fb5810464f53529bb39b4327fb74c75be52e9bd5565ae3ee1ec7

  • Size

    1.7MB

  • Sample

    240824-zt345syhmf

  • MD5

    acd6100b0f2c783fe09740e441c8db8d

  • SHA1

    16e00b046fd09937b40ad374b2ed998242bf3549

  • SHA256

    9690eff3fd51fb5810464f53529bb39b4327fb74c75be52e9bd5565ae3ee1ec7

  • SHA512

    b37ac4958d6f59d7023f2cb4b8946e28df79c8573a050bd29a09c1c388f517f0e4111e0b60f87fcdd6ae5e6cb4db39f0f7fba941d3f6e9d31108ea62edfa87e9

  • SSDEEP

    24576:8IvTGr3eN6ufUkfCtAAIGQa5Acxueg5WdoFUl6rj6WiJrD13Hqn5gxF/P:8IvCWXRA7QejIevdtlQ6WiJBAgxFn

Malware Config

Extracted

Family

stealc

Botnet

leva

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Targets

    • Target

      9690eff3fd51fb5810464f53529bb39b4327fb74c75be52e9bd5565ae3ee1ec7

    • Size

      1.7MB

    • MD5

      acd6100b0f2c783fe09740e441c8db8d

    • SHA1

      16e00b046fd09937b40ad374b2ed998242bf3549

    • SHA256

      9690eff3fd51fb5810464f53529bb39b4327fb74c75be52e9bd5565ae3ee1ec7

    • SHA512

      b37ac4958d6f59d7023f2cb4b8946e28df79c8573a050bd29a09c1c388f517f0e4111e0b60f87fcdd6ae5e6cb4db39f0f7fba941d3f6e9d31108ea62edfa87e9

    • SSDEEP

      24576:8IvTGr3eN6ufUkfCtAAIGQa5Acxueg5WdoFUl6rj6WiJrD13Hqn5gxF/P:8IvCWXRA7QejIevdtlQ6WiJBAgxFn

    • Stealc

      Stealc is an infostealer written in C++.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks