Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    BoostraperV3.exe

  • Size

    8.2MB

  • Sample

    240825-q4th1sygnm

  • MD5

    21e1e2b2f4f4cbe5294a8cbd5598126d

  • SHA1

    b1ebcdd600fef8073d51536d76d168374989e0a0

  • SHA256

    df0a7c06c8c5b7d76623f6294f42a4558f4838b0e3d56e289bd1351dcc047d63

  • SHA512

    335a0da752a285726bd7ca74688b6432235db1d37634aae5f82037cced4d367d33ac0cbfa115900e31005a088def1668a51f80e792a0a7d3e9cef4878c6c281e

  • SSDEEP

    196608:zr09V3murErvI9pWjgfPvzm6gspQhE14Ar:nUtmurEUWjC3zDQh04Ar

Malware Config

Targets

    • Target

      BoostraperV3.exe

    • Size

      8.2MB

    • MD5

      21e1e2b2f4f4cbe5294a8cbd5598126d

    • SHA1

      b1ebcdd600fef8073d51536d76d168374989e0a0

    • SHA256

      df0a7c06c8c5b7d76623f6294f42a4558f4838b0e3d56e289bd1351dcc047d63

    • SHA512

      335a0da752a285726bd7ca74688b6432235db1d37634aae5f82037cced4d367d33ac0cbfa115900e31005a088def1668a51f80e792a0a7d3e9cef4878c6c281e

    • SSDEEP

      196608:zr09V3murErvI9pWjgfPvzm6gspQhE14Ar:nUtmurEUWjC3zDQh04Ar

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

    • Enumerates processes with tasklist

MITRE ATT&CK Enterprise v15

Tasks