Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
Artic.exe
-
Size
7.4MB
-
Sample
240710-j7pwnsyfkd
-
MD5
b1da93350f3c968fc3632997ab5a9ac2
-
SHA1
b8f9388e3b29218b6860167c825dfece6d5adfa8
-
SHA256
f0fd55719640ba0ce349df5e3de0b043ba11f53551e6454129240b488df673b1
-
SHA512
aeb24ffe86ec47cb6b1236840af065f8cfef781ff455bef5b5f4da157e13ef8d88c965ddd91fb0c785028c3c32370b2a39375c133cd9d38feb32282952d0e688
-
SSDEEP
98304:63VeYgZhU0way6OshoKyDvuIYc5AhV+gEc4kZvRLoI0EJfNA3zCUTVv9JT1sOBNJ:6wYS6UOshoKMuIkhVastRL5Di3u01D7J
Behavioral task
behavioral1
Sample
Artic.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Artic.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
�}l��.pyc
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
�}l��.pyc
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
Artic.exe
-
Size
7.4MB
-
MD5
b1da93350f3c968fc3632997ab5a9ac2
-
SHA1
b8f9388e3b29218b6860167c825dfece6d5adfa8
-
SHA256
f0fd55719640ba0ce349df5e3de0b043ba11f53551e6454129240b488df673b1
-
SHA512
aeb24ffe86ec47cb6b1236840af065f8cfef781ff455bef5b5f4da157e13ef8d88c965ddd91fb0c785028c3c32370b2a39375c133cd9d38feb32282952d0e688
-
SSDEEP
98304:63VeYgZhU0way6OshoKyDvuIYc5AhV+gEc4kZvRLoI0EJfNA3zCUTVv9JT1sOBNJ:6wYS6UOshoKMuIkhVastRL5Di3u01D7J
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
-
-
Target
�}l��.pyc
-
Size
1KB
-
MD5
cec03cf278361e8eb0cc1a44553e53ba
-
SHA1
5a0e8504b57bc0c65c8803509d94d59deeae593f
-
SHA256
e8fbb5ffb59b956d508e9e1aaf14284bbfc346f8395c1a5fcfdca1a9d969c1ab
-
SHA512
6cd6edf00d1ec9a8e47df1cc74cb4c0a76348adc8bbe2fa67f5e5c975b2aa30839ad4e3440c11f9e35f8261d0e1d0f4d6bee7f3932045bc6484a2668ad891496
Score1/10 -