Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

img_0933.exe

windows7_x64

10

img_0933.exe

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    img_0933.exe

  • Size

    1.4MB

  • Sample

    200713-yzlhw9cd9a

  • MD5

    f8d0bab3e3367fbd94c1f82eb33714e7

  • SHA1

    e457ae2ad469dd932300a02a4e3b9c03010d5e31

  • SHA256

    cc6b0848a3a848c9ee7ce3f63d1e3f95393f6593140e2aab400146c06e593793

  • SHA512

    0064460f534399a26e4dd2e29804c3f8b7cd3d8b97808a9ae713c6e7eed0facd621ed3d98f3dad1b655ed051e069fbb9e513b1d51d0ccf61bfde30f668c65784

Score
10/10
massloggerpersistencespywarestealer

Malware Config

Targets

    • Target

      img_0933.exe

    • Size

      1.4MB

    • MD5

      f8d0bab3e3367fbd94c1f82eb33714e7

    • SHA1

      e457ae2ad469dd932300a02a4e3b9c03010d5e31

    • SHA256

      cc6b0848a3a848c9ee7ce3f63d1e3f95393f6593140e2aab400146c06e593793

    • SHA512

      0064460f534399a26e4dd2e29804c3f8b7cd3d8b97808a9ae713c6e7eed0facd621ed3d98f3dad1b655ed051e069fbb9e513b1d51d0ccf61bfde30f668c65784

    Score
    10/10
    persistencespywarestealermasslogger

    • MassLogger

      Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.

      stealerspywaremasslogger

    • MassLogger log file

      Detects a log file produced by MassLogger.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run entry to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks