Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    014cfaa83d7a191262b49797e933b22109789f391772ee4398046a7a6f8908d1.exe

  • Size

    3.8MB

  • Sample

    240903-beftastepa

  • MD5

    f977d7f7ebb1f16f24eed12999161be6

  • SHA1

    e0373e00cbf1991e18740768969647c1e855ad89

  • SHA256

    014cfaa83d7a191262b49797e933b22109789f391772ee4398046a7a6f8908d1

  • SHA512

    b36ec676a669a6aee88845f93ce6fe5266208622e3cf714f320507e3c0dd8d14fc9d3a4455efdc31205221a026625b4b87987f32717a203733b3245823f69705

  • SSDEEP

    3072:AVgi4IidUyJWHkH+wWtaigGlIQZboLRd9ua/aHyvZRCd2iB5GW+3XhrjQIRM2Blp:AVVIdUfA7BGlVbAKGxFW9e

Malware Config

Targets

    • Target

      014cfaa83d7a191262b49797e933b22109789f391772ee4398046a7a6f8908d1.exe

    • Size

      3.8MB

    • MD5

      f977d7f7ebb1f16f24eed12999161be6

    • SHA1

      e0373e00cbf1991e18740768969647c1e855ad89

    • SHA256

      014cfaa83d7a191262b49797e933b22109789f391772ee4398046a7a6f8908d1

    • SHA512

      b36ec676a669a6aee88845f93ce6fe5266208622e3cf714f320507e3c0dd8d14fc9d3a4455efdc31205221a026625b4b87987f32717a203733b3245823f69705

    • SSDEEP

      3072:AVgi4IidUyJWHkH+wWtaigGlIQZboLRd9ua/aHyvZRCd2iB5GW+3XhrjQIRM2Blp:AVVIdUfA7BGlVbAKGxFW9e

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks