Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    9260b031bc5e822b632335447698e4a0d4df98f2be89c750b16e6567a1c852b0.exe

  • Size

    274KB

  • Sample

    250215-1223gsxle1

  • MD5

    b48e2f9b558ecdaaeaeef4016d44ae7d

  • SHA1

    88780ab2c40ebc2cb1d28f960e6bbc73159938f4

  • SHA256

    9260b031bc5e822b632335447698e4a0d4df98f2be89c750b16e6567a1c852b0

  • SHA512

    2827d7a391efe484f9b53a9f542f2ed3cc628c455d8206e5d6cdf7cb37ac38d1df0d2c9c57c9e15ab3352b7afc7e9d57a64e9094b8f5f8b7e08b1dbbba250307

  • SSDEEP

    6144:Wf+BLtABPDkkZ68Dm6pwyUruui8XafTyClI1D0vDx+:xozqyUruuzf1DAx+

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1338494455816130602/RfPMucy7qNgnF1KO1MI5iOATLOqPdaYE1pn3HhuPCtXjqRXs3t1NFhCJsYBUYOc2mSD5

Targets

    • Target

      9260b031bc5e822b632335447698e4a0d4df98f2be89c750b16e6567a1c852b0.exe

    • Size

      274KB

    • MD5

      b48e2f9b558ecdaaeaeef4016d44ae7d

    • SHA1

      88780ab2c40ebc2cb1d28f960e6bbc73159938f4

    • SHA256

      9260b031bc5e822b632335447698e4a0d4df98f2be89c750b16e6567a1c852b0

    • SHA512

      2827d7a391efe484f9b53a9f542f2ed3cc628c455d8206e5d6cdf7cb37ac38d1df0d2c9c57c9e15ab3352b7afc7e9d57a64e9094b8f5f8b7e08b1dbbba250307

    • SSDEEP

      6144:Wf+BLtABPDkkZ68Dm6pwyUruui8XafTyClI1D0vDx+:xozqyUruuzf1DAx+

    • 44Caliber

      An open source infostealer written in C#.

    • 44Caliber family

    • Downloads MZ/PE file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks