Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

My_Singing...es.exe

windows7-x64

7

My_Singing...es.exe

windows10-2004-x64

9

Creal.pyc

windows7-x64

3

Creal.pyc

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    My_Singing_Monsters_Supernova_Histories.exe

  • Size

    14.4MB

  • Sample

    240802-wsylgsyhmf

  • MD5

    f73d86d8e4a0ff4046a0f830b2908adb

  • SHA1

    98747291e14f9a5ab1a1f672b82721cd542f805a

  • SHA256

    8b9edb3a35c74557d8381368f0ab0ed64f3e20b2e2f1e9fe22f4f3edf89d556c

  • SHA512

    ae07659435de558a2cac6b8f6682e7d11e47eb4439c3bb329a00b658993b1582dd243df3a5577d8d6b276311725a2f38e40f413087f7a75ae48a21c34cbb8b4a

  • SSDEEP

    393216:LiIE7YoPQQdQuslSq99oWOv+9fgcTeiUW/row:47rPQQdQuSDorvSYcTeo/5

Score
10/10
crealstealercredential_accessdiscoverypyinstallerspywarestealer

Malware Config

Targets

    • Target

      My_Singing_Monsters_Supernova_Histories.exe

    • Size

      14.4MB

    • MD5

      f73d86d8e4a0ff4046a0f830b2908adb

    • SHA1

      98747291e14f9a5ab1a1f672b82721cd542f805a

    • SHA256

      8b9edb3a35c74557d8381368f0ab0ed64f3e20b2e2f1e9fe22f4f3edf89d556c

    • SHA512

      ae07659435de558a2cac6b8f6682e7d11e47eb4439c3bb329a00b658993b1582dd243df3a5577d8d6b276311725a2f38e40f413087f7a75ae48a21c34cbb8b4a

    • SSDEEP

      393216:LiIE7YoPQQdQuslSq99oWOv+9fgcTeiUW/row:47rPQQdQuSDorvSYcTeo/5

    Score
    9/10
    credential_accessdiscoveryspywarestealer

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery
    behavioral1behavioral2

    • Target

      Creal.pyc

    • Size

      75KB

    • MD5

      ac1777ac9ce0ddaa06db4610ffa8062f

    • SHA1

      407d1632142e1e4a57787809897c13adaea32803

    • SHA256

      9ffc9277c6ad71a716e2fc5c3b7c7fb978590ad590e50c66fec330130b2031ae

    • SHA512

      b075217b03cf1e71d90ddccfe6c1390bdb56e48ef808abebef55bbc411e6c36fe4279c52c384e6aeaf1fdfe1d352e67a8fb97937148c907ffe35bf88095d25fa

    • SSDEEP

      1536:IuKDrie3uzTZMB7aK168pN6CifPsfCzHk4ROvo/I:nKDGe3uz0Bs8pN6C6PCCzdg5

    Score
    3/10
    discovery
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks