Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    feb74e768dc8cc7bf98c20ea8f2f23e5c3ffc8e327a41cd21d96bedf10ae7efe

  • Size

    1.7MB

  • Sample

    240901-rese4atbmc

  • MD5

    b0cf5e71ca872709d9445931c2aaad6a

  • SHA1

    9793982f71ccab73d3dcc6ae13e76e537823f1c6

  • SHA256

    feb74e768dc8cc7bf98c20ea8f2f23e5c3ffc8e327a41cd21d96bedf10ae7efe

  • SHA512

    261f63dfcb6458f923cc0a0272a4bf068c83115ee2e838c79cc3055664959abd65413d3bd216b1a47706c39d7bff45d6b1ecf02d2926a65dde2845795d8e58b8

  • SSDEEP

    24576:oWMA+zJ7Cze7EbuKEEqlA0kce1dJOyZUR0m5K1O8Uu/4cBWEbR+wiWua5UYdcziP:l+zZCzMLKeljkceYyaiQ8d3BVgYdq0L

Malware Config

Extracted

Family

stealc

Botnet

leva

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Targets

    • Target

      feb74e768dc8cc7bf98c20ea8f2f23e5c3ffc8e327a41cd21d96bedf10ae7efe

    • Size

      1.7MB

    • MD5

      b0cf5e71ca872709d9445931c2aaad6a

    • SHA1

      9793982f71ccab73d3dcc6ae13e76e537823f1c6

    • SHA256

      feb74e768dc8cc7bf98c20ea8f2f23e5c3ffc8e327a41cd21d96bedf10ae7efe

    • SHA512

      261f63dfcb6458f923cc0a0272a4bf068c83115ee2e838c79cc3055664959abd65413d3bd216b1a47706c39d7bff45d6b1ecf02d2926a65dde2845795d8e58b8

    • SSDEEP

      24576:oWMA+zJ7Cze7EbuKEEqlA0kce1dJOyZUR0m5K1O8Uu/4cBWEbR+wiWua5UYdcziP:l+zZCzMLKeljkceYyaiQ8d3BVgYdq0L

    • Stealc

      Stealc is an infostealer written in C++.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks