Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    12db50d8781fb72163f2cc3eb674b94558050eb9e965c02ea8936ed1770ca298.exe

  • Size

    1.8MB

  • Sample

    241004-bg1aqazejh

  • MD5

    67ba8a4a441b8c1e892ab227cc5f142a

  • SHA1

    5cf0a0706a9db5ec122d52576479f62327a655b1

  • SHA256

    12db50d8781fb72163f2cc3eb674b94558050eb9e965c02ea8936ed1770ca298

  • SHA512

    378c6fdd99b64c84c677c8873041aa74892d2fc818dc75b2c4bdbabc308f8e5301994593b414eaf82669e2484f6ca9d4c1d2763ba7c7b27121c20a7c6d0afa09

  • SSDEEP

    49152:dFAjgmHKOnCX2JuUjipfS4kKjlQqjzv3aE:dhSc2JFOc49lQwzv3a

Malware Config

Extracted

Family

stealc

Botnet

doma

C2

http://185.215.113.37

Attributes
  • url_path

    /e2b1563c6670f193.php

Targets

    • Target

      12db50d8781fb72163f2cc3eb674b94558050eb9e965c02ea8936ed1770ca298.exe

    • Size

      1.8MB

    • MD5

      67ba8a4a441b8c1e892ab227cc5f142a

    • SHA1

      5cf0a0706a9db5ec122d52576479f62327a655b1

    • SHA256

      12db50d8781fb72163f2cc3eb674b94558050eb9e965c02ea8936ed1770ca298

    • SHA512

      378c6fdd99b64c84c677c8873041aa74892d2fc818dc75b2c4bdbabc308f8e5301994593b414eaf82669e2484f6ca9d4c1d2763ba7c7b27121c20a7c6d0afa09

    • SSDEEP

      49152:dFAjgmHKOnCX2JuUjipfS4kKjlQqjzv3aE:dhSc2JFOc49lQwzv3a

    • Stealc

      Stealc is an infostealer written in C++.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks