Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    EulenLoader.zip

  • Size

    6.6MB

  • Sample

    240604-x3djqshe54

  • MD5

    3f0dbd944af3fc31a97bbf23b0fd5908

  • SHA1

    d7ae863881525f57cebd4924a79055e3b2c897dd

  • SHA256

    971b18afacb9a938d8f820641c56af0d4e4c4b999114b90b698a0ecfcf234262

  • SHA512

    bd9759abe08f148010109fba16779315f3591cc65e853173588b5ab092209e82f9b3fe2f36fdce41135092e22a63d87e0fb9e4822e92ed1cd8816b501563e55d

  • SSDEEP

    196608:ZAuUN3jaRxvdIXCGU06ZGvCx0ogwAPaHfD8LkrQCAWbT7ulavt/yd:ZA3ULwCd3GFXgfIahu0VKd

Malware Config

Targets

    • Target

      EulenLoader.exe

    • Size

      17.7MB

    • MD5

      1611d81328b8108b6c9a598284c7fde4

    • SHA1

      c6127a706211414ac129cbabab04a4778cd551b9

    • SHA256

      f2c3754b6b7a050d9da9b319a724728116bc547d72c6c4be3092fb8b351f50d7

    • SHA512

      39f629965a4c13463b06c44729f661dcddf48c9eceaddd920d5f75b545594eca7977203171b869462e6a97cbb57156c0cd177f361a776a5055775f0ecb0d5f8a

    • SSDEEP

      196608:JhxxXll6qNbuDyHWbTNgSH1jkpICTvykr:JhxxzzbEy2/pkp5

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Drops file in Drivers directory

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

MITRE ATT&CK Enterprise v15

Tasks