Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

1

cs+changer.exe

windows7-x64

7

cs+changer.exe

windows10-2004-x64

9

loader-o.pyc

windows7-x64

3

loader-o.pyc

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cs+changer.exe

  • Size

    57.2MB

  • Sample

    240726-xclgnaxcpq

  • MD5

    4f89f4e58160db47d19260b5f9de9bca

  • SHA1

    9599c5e021195c4b9355f2bf6e59a6067379cfc1

  • SHA256

    50259bd5d39e1d33d5ca3250ba67333c57c11c08959d237404166b4356572aa6

  • SHA512

    d5682ae141f3e241967859bd3dbf99eda859bf3d89032457141b1372dc4d540c244a48aab8ba64aa2d3be64691a5c6f8fcaab75086d7ec3307bc0170300a364b

  • SSDEEP

    1572864:qxB7vFQqMrlpA+Ql4VdIvIe6MqQZ19Wb84xhvsZ:qxBJyklAIvNF/9e8ehM

Score
9/10
credential_accessdiscoveryexecutionpersistenceprivilege_escalationspywarestealerupx

Malware Config

Targets

    • Target

      cs+changer.exe

    • Size

      57.2MB

    • MD5

      4f89f4e58160db47d19260b5f9de9bca

    • SHA1

      9599c5e021195c4b9355f2bf6e59a6067379cfc1

    • SHA256

      50259bd5d39e1d33d5ca3250ba67333c57c11c08959d237404166b4356572aa6

    • SHA512

      d5682ae141f3e241967859bd3dbf99eda859bf3d89032457141b1372dc4d540c244a48aab8ba64aa2d3be64691a5c6f8fcaab75086d7ec3307bc0170300a364b

    • SSDEEP

      1572864:qxB7vFQqMrlpA+Ql4VdIvIe6MqQZ19Wb84xhvsZ:qxBJyklAIvNF/9e8ehM

    Score
    9/10
    upxcredential_accessdiscoveryexecutionpersistenceprivilege_escalationspywarestealer

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

    • Target

      loader-o.pyc

    • Size

      72KB

    • MD5

      427092cafbc4040445f9f440c49c0ec3

    • SHA1

      4b63e190d1ca0ddd742158fb23f55a58d05c1784

    • SHA256

      a515198d56a2213a7050c49fdbfab762024fc381f68e1267a0a89259d4bac2a9

    • SHA512

      99954365492b2a7d96ca67fddf68079729f367e8a89c951c088c8fd3ee61f0e09f182a1acfa4d9d1a711989bf4d5472ac2caf5a259baf4bbf2220150edfb7f79

    • SSDEEP

      768:dFaRsuM9ZGw1ql4az5w2GZgDH6dLOctnCceIWtYVHtGSsTmgvxmkR9gCvOT:dFaR+9ZG0azhoOcIrEVNMbv/9aT

    Score
    3/10
    discovery
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks