Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    6a3d7bcaf7fcd1ce511dea3e3eaafcf425d1c98c2c6d3e94b6b5bb66bab866f1.exe

  • Size

    1.8MB

  • Sample

    240928-bvdnwasbng

  • MD5

    36cb6ec78aa8cd0a33dfb06d03a0a389

  • SHA1

    42cc15ec861309afa84e627e563d251da1afc4c4

  • SHA256

    6a3d7bcaf7fcd1ce511dea3e3eaafcf425d1c98c2c6d3e94b6b5bb66bab866f1

  • SHA512

    f0e7be775cec5fc9710de71652fe48a3c70103e75d30868465cc47c73740fb6b163c5943e8cec4ff091e17c5d7ff7b5d682d245a58d02894d87e4fb1dd7f305b

  • SSDEEP

    49152:m8ZF3q43USo4eI5+louuCkIbceV6+PDFl83sUiitG75txsNa:/q4EFpuCkQxZbFS8Xit++Na

Malware Config

Extracted

Family

stealc

Botnet

save

C2

http://185.215.113.37

Attributes
  • url_path

    /e2b1563c6670f193.php

Targets

    • Target

      6a3d7bcaf7fcd1ce511dea3e3eaafcf425d1c98c2c6d3e94b6b5bb66bab866f1.exe

    • Size

      1.8MB

    • MD5

      36cb6ec78aa8cd0a33dfb06d03a0a389

    • SHA1

      42cc15ec861309afa84e627e563d251da1afc4c4

    • SHA256

      6a3d7bcaf7fcd1ce511dea3e3eaafcf425d1c98c2c6d3e94b6b5bb66bab866f1

    • SHA512

      f0e7be775cec5fc9710de71652fe48a3c70103e75d30868465cc47c73740fb6b163c5943e8cec4ff091e17c5d7ff7b5d682d245a58d02894d87e4fb1dd7f305b

    • SSDEEP

      49152:m8ZF3q43USo4eI5+louuCkIbceV6+PDFl83sUiitG75txsNa:/q4EFpuCkQxZbFS8Xit++Na

    • Stealc

      Stealc is an infostealer written in C++.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks