Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

XSpammer_Setup.exe

windows7-x64

7

XSpammer_Setup.exe

windows10-2004-x64

7

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows7-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

LICENSES.c...m.html

windows7-x64

1

LICENSES.c...m.html

windows10-2004-x64

1

XSpammer.exe

windows7-x64

1

XSpammer.exe

windows10-2004-x64

7

d3dcompiler_47.dll

windows10-2004-x64

1

resources/...age.js

windows7-x64

1

resources/...age.js

windows10-2004-x64

1

resources/...gif.js

windows7-x64

1

resources/...gif.js

windows10-2004-x64

1

resources/...dec.js

windows7-x64

1

resources/...dec.js

windows10-2004-x64

1

resources/...ame.js

windows7-x64

1

resources/...ame.js

windows10-2004-x64

1

resources/...til.js

windows7-x64

1

resources/...til.js

windows10-2004-x64

1

resources/...dex.js

windows7-x64

1

resources/...dex.js

windows10-2004-x64

1

resources/...DME.js

windows7-x64

1

resources/...DME.js

windows10-2004-x64

1

resources/elevate.exe

windows7-x64

1

resources/elevate.exe

windows10-2004-x64

1

swiftshade...GL.dll

windows7-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XSpammer_Setup.exe

  • Size

    72.4MB

  • Sample

    240221-1cf4qafe61

  • MD5

    1945cc6063dc247fd43d24eabe1b7533

  • SHA1

    d756893bc819e88de256f21bea88b8b752a275af

  • SHA256

    ea8e830aee3ca762fa8d37597994acf261430d0ec3f393b1861e6e9d7ac3c552

  • SHA512

    0631faf6474a96f30926784f21b9ad476ae67928028c1c68d36453e11460330b293f33280d8af117e05dda0b39f742d74a68f6d6d2dd1cee5d15f93e23201e78

  • SSDEEP

    1572864:o20upv9u+MC29R3MBJimyyF7DGbVjnmFIq41egyeUtdOg0IXiBx22kSlM3:o20upvW3cyi7DoVjn1qQ9ylhCkL

Score
7/10
discovery

Malware Config

Targets

    • Target

      XSpammer_Setup.exe

    • Size

      72.4MB

    • MD5

      1945cc6063dc247fd43d24eabe1b7533

    • SHA1

      d756893bc819e88de256f21bea88b8b752a275af

    • SHA256

      ea8e830aee3ca762fa8d37597994acf261430d0ec3f393b1861e6e9d7ac3c552

    • SHA512

      0631faf6474a96f30926784f21b9ad476ae67928028c1c68d36453e11460330b293f33280d8af117e05dda0b39f742d74a68f6d6d2dd1cee5d15f93e23201e78

    • SSDEEP

      1572864:o20upv9u+MC29R3MBJimyyF7DGbVjnmFIq41egyeUtdOg0IXiBx22kSlM3:o20upvW3cyi7DoVjn1qQ9ylhCkL

    Score
    7/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/StdUtils.dll

    • Size

      100KB

    • MD5

      c6a6e03f77c313b267498515488c5740

    • SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

    • SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

    • SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • SSDEEP

      3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

    • SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

    • SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

    • SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • SSDEEP

      192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/UAC.dll

    • Size

      14KB

    • MD5

      adb29e6b186daa765dc750128649b63d

    • SHA1

      160cbdc4cb0ac2c142d361df138c537aa7e708c9

    • SHA256

      2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

    • SHA512

      b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

    • SSDEEP

      192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs

    Score
    3/10
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/WinShell.dll

    • Size

      3KB

    • MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

    • SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

    • SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

    • SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    Score
    3/10
    behavioral10behavioral9

    • Target

      LICENSES.chromium.html

    • Size

      4.9MB

    • MD5

      8ac6bfdf42c0699b2ce9b3aadfc5a233

    • SHA1

      dd09db85821db4827d1a491993cb0311855d5d86

    • SHA256

      a6692be8af33d0673504a5d2bd519f4738aa872595eccc0434f5921185c0d56d

    • SHA512

      3868911062f5e19e570538c0104e54ce2bdce9b06185baa3ca5657724be1def9e56fecfe1e532fd504117cc1c8636b8058c0a5fa5d5c60c3d253e5d57cbfe08f

    • SSDEEP

      24576:bTUTBOmnLiLQrz62BrErzKm8bkUVQYwM/Q1OuS:/GOmLAOfNC+1C1M

    Score
    1/10
    behavioral11behavioral12

    • Target

      XSpammer.exe

    • Size

      125.0MB

    • MD5

      123d82725f2fe084f2df4c7c12265777

    • SHA1

      94bd38f170fe619777b5eb8cb2e1978ccc6efecf

    • SHA256

      333c92f0ef14c88610341187b4f5ab54f9afe91c767d383e1578d6bc5706b32e

    • SHA512

      10781fd04263d314b7d357e2d756656f643c2416a2de45e413b28dcd3781bd72d9fdf2ce253b4471c4679c314c4cee8f7ee63e7007418b24de96f765b9e143b5

    • SSDEEP

      1572864:8NNR5hJdL+/D6n+Ik9FYHHND5vfgIi9is0COnRaW3gcT:8PMu+IsFY7Z/Nv

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral13behavioral14

    • Target

      d3dcompiler_47.dll

    • Size

      4.3MB

    • MD5

      7641e39b7da4077084d2afe7c31032e0

    • SHA1

      2256644f69435ff2fee76deb04d918083960d1eb

    • SHA256

      44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47

    • SHA512

      8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5

    • SSDEEP

      49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt

    Score
    1/10
    behavioral15

    • Target

      resources/app.asar.unpacked/node_modules/gifwrap/src/bitmapimage.js

    • Size

      12KB

    • MD5

      1589c3ea072c26e59bb5b012716a6502

    • SHA1

      4d7038ce0f3d8a664724035810f8572e0f966886

    • SHA256

      147e413866556db9f79ebb0a8fd7cca6c57c59aed9da1f35fc5d731553a5d863

    • SHA512

      5c64e64adba7ed40b6dd20fc718aea9f1d9cd9ce20123a2277f210c5eca9f2f9bd5692dfb6f4fc502ff3b91bb3285acc05f289295f1d56bf704a44c9d68da465

    • SSDEEP

      192:Sdl9A2u5Ovy7ACyPUqFqBs2Taol+vsYOiVuBZuGagH5IJzaEP3gOa+Y8UymywiIf:wjAyIalXgHGzaE1SiCh8++Tn6

    Score
    1/10
    behavioral16behavioral17

    • Target

      resources/app.asar.unpacked/node_modules/gifwrap/src/gif.js

    • Size

      2KB

    • MD5

      ef5be4f426dc15ca0af2aca56c40151a

    • SHA1

      974f4861dffeb8e4f403af8c015952855177dcfb

    • SHA256

      e0ca546dc16f6f80a2d2cc90a1ef8857f51d868fbea750a78132fe0c8f236d12

    • SHA512

      73d16855bfbcea4cd3f94911bfe21426be0a6c534be136672d3138f9e787d6f1dabf9c2d9a5232557bbca6d2f9711832f2e97f5665e0d2862c22a0863f2804ba

    Score
    1/10
    behavioral18behavioral19

    • Target

      resources/app.asar.unpacked/node_modules/gifwrap/src/gifcodec.js

    • Size

      15KB

    • MD5

      0cbf70efaff7a60806477e5d9b7e6faf

    • SHA1

      ff1e24531a7f5a43706563359c06917a1ef9c824

    • SHA256

      a9dc8297420be29fe054c158e4564f7e75bc4385e03b0202758eac4bb6895ca3

    • SHA512

      921d464d474e61778bd35f63109ed874e28b832434e1274dfc127ccc46d2247c7ec38e554ed807fc23111f3f58e73f9b26fd0373acc7a8814b3a38f7a053e0ff

    • SSDEEP

      384:5cjsxzV1FIzp1ACgL74PssC21GoZEVC5pAWgRAjyYNXV0h:28Vzi3ACgLcPHI8zYwyYN6h

    Score
    1/10
    behavioral20behavioral21

    • Target

      resources/app.asar.unpacked/node_modules/gifwrap/src/gifframe.js

    • Size

      5KB

    • MD5

      ae9c39af875f39e1c73ce4e321d8015b

    • SHA1

      f7e3342b02ccd65ca5269ace92f19336fd863101

    • SHA256

      f6a575d76bea126239da8701cb32cb4337c9adc3c76790b04601b62f2cb69e1b

    • SHA512

      5ecd03815d7b03e26d88463e3de53aaa1b498759d503a0c270a630b0501a27c71ffbd8373edfaef9a54302af86538141a4949eff5ffad021ae416d46a098e526

    • SSDEEP

      96:ushhAncTafofWGj5eCz+wqKT/A4Ja5TAZN6Gneh9nZ5azASNfvwYxi:ughAcv+wqM/rJapAZnn8ZZ5azz54L

    Score
    1/10
    behavioral22behavioral23

    • Target

      resources/app.asar.unpacked/node_modules/gifwrap/src/gifutil.js

    • Size

      16KB

    • MD5

      c4dfbc13191de1161d63ecce64366bd3

    • SHA1

      b1d59450342cb60c5a2579c07fa3ab23d889a118

    • SHA256

      ce2b08cf6733268c6f580f9a4e982cee584c3b3cf4685e5eb9f12c1388eef266

    • SHA512

      ca528ef4c71b42b566c91b8e186fb3934fd4a7d30313f6f5ae70c01c4c7aa0349bd6bd8bd52ed61cf9c622acb29d9b699508d5919c625176cab8b885591040db

    • SSDEEP

      384:Qrl0rxVgSxv+lpdOx/hr79r7S8Te7t2bNY:JxEox/l9r7t63

    Score
    1/10
    behavioral24behavioral25

    • Target

      resources/app.asar.unpacked/node_modules/gifwrap/src/index.js

    • Size

      334B

    • MD5

      f856b9cef0fad47e2f2e09f9765ec0ed

    • SHA1

      1e9d6f370a866b5cf96f33a50ecad832d1d34dcc

    • SHA256

      a48ce65f5194bf69cbea661e5861504f89c4c898f371f219a180c81d1cbacc95

    • SHA512

      b43a1274a9abff0041b23f761d22ee033fcf3a9880378588002c082e91ca4db4fb9a44010b5763b21d92bb48f130020bd84d25f75e87e1f5c478b78fc85ebee4

    Score
    1/10
    behavioral26behavioral27

    • Target

      resources/app.asar.unpacked/node_modules/gifwrap/templates/README.hbs

    • Size

      10KB

    • MD5

      4604df17d8c3c747406aea2861f3e531

    • SHA1

      1ef127349fc0c2b7923abe1158e41fb145d7343e

    • SHA256

      95a51cb7b91c97cf5b3cdaf9bf4db83cb0a6ac65b9d3316e13eb8063bae3449b

    • SHA512

      aeafad021bda13625db95ec7a97aa4a8e7a6b6158600cb1f7ccc0707e4c36659582fa7638b141fec346d7c6601f24f2940fc91790f2edd707fb2cc7025708418

    • SSDEEP

      192:MiAsgfNPzjDCViEHByAK6tbw3aD7AfnUqzvbYLSIQHTL:bynWPtbkauyX6L

    Score
    1/10
    behavioral28behavioral29

    • Target

      resources/elevate.exe

    • Size

      105KB

    • MD5

      792b92c8ad13c46f27c7ced0810694df

    • SHA1

      d8d449b92de20a57df722df46435ba4553ecc802

    • SHA256

      9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37

    • SHA512

      6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

    • SSDEEP

      3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l

    Score
    1/10
    behavioral30behavioral31

    • Target

      swiftshader/libEGL.dll

    • Size

      458KB

    • MD5

      e7ebe009ba3280440dc7a93b48a70bf0

    • SHA1

      15aa73b00146630be39b250e299ff4c8f581dd16

    • SHA256

      761496fd75d291a532fea9f553f9fc36bf9ae2fa6c3488f022bb16b7c0cb6f5b

    • SHA512

      1167af849517d1c8361333c1cd315f71535506b47d250788790d8fdabaf2ac4d0f432c7f6526a65e6a0d5dfe1f1810a19de06832d0d6844039802941a1eb5168

    • SSDEEP

      6144:L6txlbRay7iVeTIM4gkZ8A9YfCmpmXZvrpeK8MbhGG+gwLuggcAgAeG4:LPZ4IM4u7BmXZXGurcAD

    Score
    1/10
    behavioral32

MITRE ATT&CK Enterprise v15

Tasks