Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
EulenLoader.zip
-
Size
6.6MB
-
Sample
240604-x3djqshe54
-
MD5
3f0dbd944af3fc31a97bbf23b0fd5908
-
SHA1
d7ae863881525f57cebd4924a79055e3b2c897dd
-
SHA256
971b18afacb9a938d8f820641c56af0d4e4c4b999114b90b698a0ecfcf234262
-
SHA512
bd9759abe08f148010109fba16779315f3591cc65e853173588b5ab092209e82f9b3fe2f36fdce41135092e22a63d87e0fb9e4822e92ed1cd8816b501563e55d
-
SSDEEP
196608:ZAuUN3jaRxvdIXCGU06ZGvCx0ogwAPaHfD8LkrQCAWbT7ulavt/yd:ZA3ULwCd3GFXgfIahu0VKd
Static task
static1
Behavioral task
behavioral1
Sample
EulenLoader.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
EulenLoader.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
EulenLoader.exe
-
Size
17.7MB
-
MD5
1611d81328b8108b6c9a598284c7fde4
-
SHA1
c6127a706211414ac129cbabab04a4778cd551b9
-
SHA256
f2c3754b6b7a050d9da9b319a724728116bc547d72c6c4be3092fb8b351f50d7
-
SHA512
39f629965a4c13463b06c44729f661dcddf48c9eceaddd920d5f75b545594eca7977203171b869462e6a97cbb57156c0cd177f361a776a5055775f0ecb0d5f8a
-
SSDEEP
196608:JhxxXll6qNbuDyHWbTNgSH1jkpICTvykr:JhxxzzbEy2/pkp5
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1