Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

72727777.exe

windows11-21h2-x64

7

cstealer.pyc

windows11-21h2-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    72727777.exe

  • Size

    11.1MB

  • Sample

    241013-pyyecaxbla

  • MD5

    db00d9800f43f19fda3a8e2b256364e9

  • SHA1

    ad439005298c5520de484bfdaed5ec8b9ec68a1b

  • SHA256

    0c1307e0d0e5bf8e40e8ec0011c5b896af7c04ffd3ca8beefb23ce33e5557c2a

  • SHA512

    43c299676433eb96f06c7d422e6a0af282ec410b0a319af6683218b3d6b5e8cdd46c853b2b7ab06a1e2fb4eaebaa7f5cc305fca32bf030074022e11fb69b1d58

  • SSDEEP

    196608:WWF9Yi0x6YKjXMCHGLLc54i1wN+rPIcu9KYK39sevBaVSEo3PPBZMe+OdNc/ip:TF9Yi2qXMCHWUjMcuIhvz9/PBZXia

Score
7/10
credential_accessdiscoverypyinstallerspywarestealer

Malware Config

Targets

    • Target

      72727777.exe

    • Size

      11.1MB

    • MD5

      db00d9800f43f19fda3a8e2b256364e9

    • SHA1

      ad439005298c5520de484bfdaed5ec8b9ec68a1b

    • SHA256

      0c1307e0d0e5bf8e40e8ec0011c5b896af7c04ffd3ca8beefb23ce33e5557c2a

    • SHA512

      43c299676433eb96f06c7d422e6a0af282ec410b0a319af6683218b3d6b5e8cdd46c853b2b7ab06a1e2fb4eaebaa7f5cc305fca32bf030074022e11fb69b1d58

    • SSDEEP

      196608:WWF9Yi0x6YKjXMCHGLLc54i1wN+rPIcu9KYK39sevBaVSEo3PPBZMe+OdNc/ip:TF9Yi2qXMCHWUjMcuIhvz9/PBZXia

    Score
    7/10
    credential_accessdiscoveryspywarestealer

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

    • Target

      cstealer.pyc

    • Size

      67KB

    • MD5

      53d063a021e1a431dbe2497b3baeaa7d

    • SHA1

      7a24f9e56566e766ab974b2c1ac19da9148f8ca9

    • SHA256

      679d32660b92d4d250debfb374d76531f824ae4ee2e815362d133c6b79e76017

    • SHA512

      2d000303da74ed1a93c3d95d8663bf3e08fa7e1a0e9f5fe5cdb9fc2e284ea6e09e8f78ec469c3a1ee0d6ad6f0ebe4b364fc2717dc5d4c232711fa09977b3c460

    • SSDEEP

      1536:ZANFO+f0ejZJlLkMNXmro+AAy9aWkX1R9e2:Zb+LvNXeo+AAAkX1RF

    Score
    3/10
    behavioral2

MITRE ATT&CK Enterprise v15

Tasks