Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    8c5f58b2abcbb73f05d0d96bc1dd056bce130ce4f3209cfe02529b6b03ef86f1

  • Size

    1.8MB

  • Sample

    241127-b1brgawqfm

  • MD5

    5fcab4c0e9af5adc2963461bf81e0a5d

  • SHA1

    f81122d741b6de1503e7625feea68233ae29f670

  • SHA256

    8c5f58b2abcbb73f05d0d96bc1dd056bce130ce4f3209cfe02529b6b03ef86f1

  • SHA512

    9fb90dbe48aba5ba7ac1e44cc97d5c498d8bb9a4f1fa397c3be1dfc76e1d072a319c13551d56677bcb156a37e8dcb8f464335d9e785c9e262087faa36ac88932

  • SSDEEP

    49152:JqJPRWVSRuI1dPbV3CrNFVPkTXoM2DWizFoBI4B:8JPqsuIjPorJPdzzFoB

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain
1
006700e5a2ab05704bbb0c589b88924d

Extracted

Family

lumma

C2

https://powerful-avoids.sbs

https://motion-treesz.sbs

https://disobey-curly.sbs

https://leg-sate-boat.sbs

https://story-tense-faz.sbs

https://blade-govern.sbs

https://occupy-blushi.sbs

https://frogs-severz.sbs

https://property-imper.sbs

Extracted

Family

stealc

Botnet

mars

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://blade-govern.sbs/api

https://story-tense-faz.sbs/api

Targets

    • Target

      8c5f58b2abcbb73f05d0d96bc1dd056bce130ce4f3209cfe02529b6b03ef86f1

    • Size

      1.8MB

    • MD5

      5fcab4c0e9af5adc2963461bf81e0a5d

    • SHA1

      f81122d741b6de1503e7625feea68233ae29f670

    • SHA256

      8c5f58b2abcbb73f05d0d96bc1dd056bce130ce4f3209cfe02529b6b03ef86f1

    • SHA512

      9fb90dbe48aba5ba7ac1e44cc97d5c498d8bb9a4f1fa397c3be1dfc76e1d072a319c13551d56677bcb156a37e8dcb8f464335d9e785c9e262087faa36ac88932

    • SSDEEP

      49152:JqJPRWVSRuI1dPbV3CrNFVPkTXoM2DWizFoBI4B:8JPqsuIjPorJPdzzFoB

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Amadey family

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Cryptbot family

    • Detects CryptBot payload

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Modifies Windows Defender Real-time Protection settings

    • Stealc

      Stealc is an infostealer written in C++.

    • Stealc family

    • Enumerates VirtualBox registry keys

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Downloads MZ/PE file

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.