Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    5cdd3f667134ad3cda79c81353c37860885bf84c7419da1e9aeb14993850a1a2

  • Size

    1.7MB

  • Sample

    250107-xpj5cswlbq

  • MD5

    c3b99e00883a10bfd3b0d0c0776f65f7

  • SHA1

    a51dcd3f1869aab5cb247267ffe258789a58a6a3

  • SHA256

    5cdd3f667134ad3cda79c81353c37860885bf84c7419da1e9aeb14993850a1a2

  • SHA512

    5e3a6ab133d4e876b27b3532945804b039511005248cdea9b1b31ac2d83aba654198ee1cfe05613fc63892ba0719f98fb36bffd0d3576ff8f374ddd6b87670ed

  • SSDEEP

    24576:0JZuYcUmAT5YtZ8qaKPRHD/Z8lbK7TGBNnMj5Yo8QB+ItX0lQbHRX5SZWuwz:0JZuckXjobvznMV+Ql0mbHOZWh

Malware Config

Extracted

Family

stealc

Botnet

brat

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Targets

    • Target

      5cdd3f667134ad3cda79c81353c37860885bf84c7419da1e9aeb14993850a1a2

    • Size

      1.7MB

    • MD5

      c3b99e00883a10bfd3b0d0c0776f65f7

    • SHA1

      a51dcd3f1869aab5cb247267ffe258789a58a6a3

    • SHA256

      5cdd3f667134ad3cda79c81353c37860885bf84c7419da1e9aeb14993850a1a2

    • SHA512

      5e3a6ab133d4e876b27b3532945804b039511005248cdea9b1b31ac2d83aba654198ee1cfe05613fc63892ba0719f98fb36bffd0d3576ff8f374ddd6b87670ed

    • SSDEEP

      24576:0JZuYcUmAT5YtZ8qaKPRHD/Z8lbK7TGBNnMj5Yo8QB+ItX0lQbHRX5SZWuwz:0JZuckXjobvznMV+Ql0mbHOZWh

    • Stealc

      Stealc is an infostealer written in C++.

    • Stealc family

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks