Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    ThunderKitty_Built.exe

  • Size

    9.7MB

  • Sample

    241219-rz9vwatrcw

  • MD5

    6fac67027fa756d82665d69627f21cd4

  • SHA1

    cd62b5622a58f88c9a62dfa68804b1017d312f6e

  • SHA256

    0da67f4bffe1d30feabc5d784579dd119f131ae2380327d3fc32dd17aedba1f9

  • SHA512

    a5bbb300aaf508165e7da51d64fe54ccd4fc62401c9339444254bf05012b9dc4071c3cd6ed7651d094feced705bc9bbf601d182353d167b1e9be09c27dcedb35

  • SSDEEP

    98304:v9Rjwt5p24UX+fgIhC+XP1chzKEuVSjMAh80q:V/WxP1clXd8D

Malware Config

Targets

    • Target

      ThunderKitty_Built.exe

    • Size

      9.7MB

    • MD5

      6fac67027fa756d82665d69627f21cd4

    • SHA1

      cd62b5622a58f88c9a62dfa68804b1017d312f6e

    • SHA256

      0da67f4bffe1d30feabc5d784579dd119f131ae2380327d3fc32dd17aedba1f9

    • SHA512

      a5bbb300aaf508165e7da51d64fe54ccd4fc62401c9339444254bf05012b9dc4071c3cd6ed7651d094feced705bc9bbf601d182353d167b1e9be09c27dcedb35

    • SSDEEP

      98304:v9Rjwt5p24UX+fgIhC+XP1chzKEuVSjMAh80q:V/WxP1clXd8D

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks