Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Artic.exe

windows7-x64

7

Artic.exe

windows10-2004-x64

8

�}l��.pyc

windows7-x64

�}l��.pyc

windows10-2004-x64

Resubmissions

10/07/2024, 08:20

240710-j8jq2sxajj 10

10/07/2024, 08:18

240710-j7pwnsyfkd 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Artic.exe

  • Size

    7.4MB

  • Sample

    240710-j7pwnsyfkd

  • MD5

    b1da93350f3c968fc3632997ab5a9ac2

  • SHA1

    b8f9388e3b29218b6860167c825dfece6d5adfa8

  • SHA256

    f0fd55719640ba0ce349df5e3de0b043ba11f53551e6454129240b488df673b1

  • SHA512

    aeb24ffe86ec47cb6b1236840af065f8cfef781ff455bef5b5f4da157e13ef8d88c965ddd91fb0c785028c3c32370b2a39375c133cd9d38feb32282952d0e688

  • SSDEEP

    98304:63VeYgZhU0way6OshoKyDvuIYc5AhV+gEc4kZvRLoI0EJfNA3zCUTVv9JT1sOBNJ:6wYS6UOshoKMuIkhVastRL5Di3u01D7J

Score
10/10
blankgrabberexecutionpersistenceprivilege_escalationspywarestealerupx

Malware Config

Targets

    • Target

      Artic.exe

    • Size

      7.4MB

    • MD5

      b1da93350f3c968fc3632997ab5a9ac2

    • SHA1

      b8f9388e3b29218b6860167c825dfece6d5adfa8

    • SHA256

      f0fd55719640ba0ce349df5e3de0b043ba11f53551e6454129240b488df673b1

    • SHA512

      aeb24ffe86ec47cb6b1236840af065f8cfef781ff455bef5b5f4da157e13ef8d88c965ddd91fb0c785028c3c32370b2a39375c133cd9d38feb32282952d0e688

    • SSDEEP

      98304:63VeYgZhU0way6OshoKyDvuIYc5AhV+gEc4kZvRLoI0EJfNA3zCUTVv9JT1sOBNJ:6wYS6UOshoKMuIkhVastRL5Di3u01D7J

    Score
    8/10
    upxexecutionpersistenceprivilege_escalationspywarestealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

    • Target

      �}l��.pyc

    • Size

      1KB

    • MD5

      cec03cf278361e8eb0cc1a44553e53ba

    • SHA1

      5a0e8504b57bc0c65c8803509d94d59deeae593f

    • SHA256

      e8fbb5ffb59b956d508e9e1aaf14284bbfc346f8395c1a5fcfdca1a9d969c1ab

    • SHA512

      6cd6edf00d1ec9a8e47df1cc74cb4c0a76348adc8bbe2fa67f5e5c975b2aa30839ad4e3440c11f9e35f8261d0e1d0f4d6bee7f3932045bc6484a2668ad891496

    Score
    1/10
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks