Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
5cdd3f667134ad3cda79c81353c37860885bf84c7419da1e9aeb14993850a1a2
-
Size
1.7MB
-
Sample
250107-xpj5cswlbq
-
MD5
c3b99e00883a10bfd3b0d0c0776f65f7
-
SHA1
a51dcd3f1869aab5cb247267ffe258789a58a6a3
-
SHA256
5cdd3f667134ad3cda79c81353c37860885bf84c7419da1e9aeb14993850a1a2
-
SHA512
5e3a6ab133d4e876b27b3532945804b039511005248cdea9b1b31ac2d83aba654198ee1cfe05613fc63892ba0719f98fb36bffd0d3576ff8f374ddd6b87670ed
-
SSDEEP
24576:0JZuYcUmAT5YtZ8qaKPRHD/Z8lbK7TGBNnMj5Yo8QB+ItX0lQbHRX5SZWuwz:0JZuckXjobvznMV+Ql0mbHOZWh
Static task
static1
Behavioral task
behavioral1
Sample
5cdd3f667134ad3cda79c81353c37860885bf84c7419da1e9aeb14993850a1a2.exe
Resource
win7-20240903-en
Malware Config
Extracted
stealc
brat
http://185.215.113.206
-
url_path
/c4becf79229cb002.php
Targets
-
-
Target
5cdd3f667134ad3cda79c81353c37860885bf84c7419da1e9aeb14993850a1a2
-
Size
1.7MB
-
MD5
c3b99e00883a10bfd3b0d0c0776f65f7
-
SHA1
a51dcd3f1869aab5cb247267ffe258789a58a6a3
-
SHA256
5cdd3f667134ad3cda79c81353c37860885bf84c7419da1e9aeb14993850a1a2
-
SHA512
5e3a6ab133d4e876b27b3532945804b039511005248cdea9b1b31ac2d83aba654198ee1cfe05613fc63892ba0719f98fb36bffd0d3576ff8f374ddd6b87670ed
-
SSDEEP
24576:0JZuYcUmAT5YtZ8qaKPRHD/Z8lbK7TGBNnMj5Yo8QB+ItX0lQbHRX5SZWuwz:0JZuckXjobvznMV+Ql0mbHOZWh
-
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-