Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

EkexClient.exe

windows10-1703-x64

7

EkexClient.exe

windows10-2004-x64

7

EkexClient.exe

windows11-21h2-x64

7

EkexClient.exe.pyc

windows10-1703-x64

3

EkexClient.exe.pyc

windows10-2004-x64

3

EkexClient.exe.pyc

windows11-21h2-x64

3

Resubmissions

07/03/2024, 09:34

240307-lj9bhsgc99 7

07/03/2024, 09:31

240307-lhafssgc68 7

07/03/2024, 09:29

240307-lf3dssgc37 7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    EkexClient.exe

  • Size

    16.7MB

  • Sample

    240307-lf3dssgc37

  • MD5

    f41449ea10867dbadbeb9984997d1667

  • SHA1

    69f2eb0752463eaad10cb18a2fff9e2fce79648a

  • SHA256

    bcfa9fc0b223c49baca3ac64ed6025355b07a67be93e482386a74748afa8e442

  • SHA512

    931d9c513b76a612ecc980291d26db8cd97f632147bea5d53d8a0fe02c955e24d7e6492e20d4102e208f46432400e8c61b8d2fce1106d49e8c040929de479230

  • SSDEEP

    393216:oh9S2nnx837Xf+h2Jp5MLurEUWjljEh01tlypd7XiWCQaa:y9Dnxq7WhpdbJ91byr+VQaa

Score
7/10
pyinstallerspywarestealerupx

Malware Config

Targets

    • Target

      EkexClient.exe

    • Size

      16.7MB

    • MD5

      f41449ea10867dbadbeb9984997d1667

    • SHA1

      69f2eb0752463eaad10cb18a2fff9e2fce79648a

    • SHA256

      bcfa9fc0b223c49baca3ac64ed6025355b07a67be93e482386a74748afa8e442

    • SHA512

      931d9c513b76a612ecc980291d26db8cd97f632147bea5d53d8a0fe02c955e24d7e6492e20d4102e208f46432400e8c61b8d2fce1106d49e8c040929de479230

    • SSDEEP

      393216:oh9S2nnx837Xf+h2Jp5MLurEUWjljEh01tlypd7XiWCQaa:y9Dnxq7WhpdbJ91byr+VQaa

    Score
    7/10
    spywarestealerupx

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2behavioral3

    • Target

      EkexClient.exe.pyc

    • Size

      69KB

    • MD5

      2a4c573d98e6559ddc315dfc091a841a

    • SHA1

      396ec4ae1c2845a867ddd3010db5da3be86c5740

    • SHA256

      ad38b897bf067494c60d592e27b36d187691b66f8fb07639c6bc436f1838d775

    • SHA512

      729096e3305421e02e3d4ddb2c2094c84bd38f264c01230bb9b127b4cf75de01bbaafb9dcf7a54d1b800521d5a59b70535ec9b6de2931a15999c71e1f3d00b54

    • SSDEEP

      768:0+PS3Irw/gMxvCWUL8OsvPi3K2nFcWAXTxcPdCA79/GleK1AnjdRnrBI5y:0TIrYv+SNxjlJKpVrn

    Score
    3/10
    behavioral4behavioral5behavioral6

MITRE ATT&CK Enterprise v15

Tasks