Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3CareUEyes/...es.exe
windows7-x64
6CareUEyes/...es.exe
windows10-2004-x64
6CareUEyes/...le.exe
windows7-x64
7CareUEyes/...le.exe
windows10-2004-x64
7$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...os.dll
windows7-x64
3$PLUGINSDI...os.dll
windows10-2004-x64
3$PLUGINSDI...sh.dll
windows7-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3$PLUGINSDI...ce.dll
windows7-x64
3$PLUGINSDI...ce.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ry.dll
windows7-x64
3$PLUGINSDI...ry.dll
windows10-2004-x64
3General
-
Target
aabebfa8a57a0e23a01d18d0c40180fd1b0e56f017a41c03d171450171ebafa1
-
Size
5.0MB
-
Sample
241015-ct4pcazalg
-
MD5
ec041e239480c65594ed9380da2be0ad
-
SHA1
9c0eecf6597c98ecfbf69f21b00c8f5610c1099d
-
SHA256
aabebfa8a57a0e23a01d18d0c40180fd1b0e56f017a41c03d171450171ebafa1
-
SHA512
52db27d87d67b30064013c3833d4fdbc373a610d32829f814e41a40568fda64c72ce82873490df5dfe305afdb3913e9f92acfaf4f56d88d696effe0cafcacc41
-
SSDEEP
98304:H9NvpDKPQ/s7AjeQaCBatkFercnu6iYZW918bWNw:H9jDEsjECBatMu6K9Wr
Static task
static1
Behavioral task
behavioral1
Sample
CareUEyes/App/CareUEyes/CareUEyes.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
CareUEyes/App/CareUEyes/CareUEyes.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
CareUEyes/CareUEyesPortable.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
CareUEyes/CareUEyesPortable.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/MoreInfo.dll
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/MoreInfo.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/execDos.dll
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/execDos.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/newadvsplash.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/newadvsplash.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/newtextreplace.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/newtextreplace.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/registry.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/registry.dll
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
CareUEyes/App/CareUEyes/CareUEyes.exe
-
Size
5.9MB
-
MD5
b0fcd926564bf3021ecaad98f6125d3e
-
SHA1
f4f68e4294bc86ddab3f3793624e0df0d00c98d4
-
SHA256
4585309f11e0ab5aca1b0c8d4f30652abb5ab5a9858f0b83ca271ef733d4b629
-
SHA512
4ecf001326ae736945a7bc7a625b34a323bd1a1878130143afc05009826e668e70c845526f229433ab38a76ce272d34224db06f7de2e02bb95c949c96c30f92d
-
SSDEEP
98304:dwqCvR1EYwlLAxscPPeL5UF0as1KygCZ0nK1TuBFgJs2zWTIgr:daR1I9AxsRRgW+gq2zWTIU
Score6/10-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
-
-
Target
CareUEyes/CareUEyesPortable.exe
-
Size
144KB
-
MD5
1c959ca67730a5bc21d17d3d0153e2df
-
SHA1
a41a306563e5b7430f0d4ce3f0620eca3e69da54
-
SHA256
b07d2acf6197e436eee90c95561342d676422726e5b63a40403df0074a1b5973
-
SHA512
d3f11383685b73dd66ced31e96d8ee36892657b20596e99437671308700f322b45e5367581ae2e42eb92f79fa88610c62cbcb22fcf7da451e4b8865c3b4a4713
-
SSDEEP
3072:lqeqOYEUXPnU7b97o6c9jHtn16p8osnBV0mp0TLZX:kEUX2b9+jNnQCLBVwB
Score7/10-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
-
-
Target
$PLUGINSDIR/MoreInfo.dll
-
Size
7KB
-
MD5
bd393029cc49b415b6c9aeb8a4936516
-
SHA1
c67fd92fffd18941bed41bfd6ac4f3b04fd123df
-
SHA256
227a4fc9408a44faa5eca608a974bd536814f97b8a4d28b4cac479727167b026
-
SHA512
3bb8e5cf4bea7e8adaa62196e58fff9031f49fd4efa78e5bd3e4b9c4e9ba1523864567521793053595d90abec719761a5964ff3abe04b93b24d52e5ffa4c1f96
-
SSDEEP
96:LEjAlUFPxXJugoImuaKbkBSEPTpsxKaVQ4Ad:gjAiFPxXJugoImJKQk8yxKaVVe
Score3/10 -
-
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
bf712f32249029466fa86756f5546950
-
SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
-
SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
-
SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
-
SSDEEP
192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
Score3/10 -
-
-
Target
$PLUGINSDIR/UAC.dll
-
Size
13KB
-
MD5
a88baad3461d2e9928a15753b1d93fd7
-
SHA1
bb826e35264968bbc3b981d8430ac55df1e6d4a6
-
SHA256
c5ab2926c268257122d0342739e73573d7eeda34c861bc7a68a02cbc69bd41af
-
SHA512
5edcf46680716930da7fd1a41b8b0426f057cf4becefb3ee84798ec8b449726afb822fb626c4942036a1ae3bb937184d1f71d0e45075abb5bf167f5d833df43a
-
SSDEEP
192:qP6KdXy+Yo7e1J8qC25a5mDFmCLGUCVGpU6uNck87I0S/TDqwyTq+:q/q3Pgd5mx6VkEck87ILCTN
Score3/10 -
-
-
Target
$PLUGINSDIR/execDos.dll
-
Size
5KB
-
MD5
0deb397ca1e716bb7b15e1754e52b2ac
-
SHA1
fbb9bcf872c5dbb4ca4c80fb21d41519bc273ef5
-
SHA256
720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f
-
SHA512
507db0bee0897660750007e7ce674406acf9e8bf942cf26ded5654c07682757b07c9eb767bead0966478abc554dc9a6461c4288dc35d12cacfadad4c128f1bb7
-
SSDEEP
96:J++xDiP4p7t7dNOt3stxtRFFXxGD6qxlnKE6ttdH3r3:Rx9pJ7jQs5toD6Cln/6tt1
Score3/10 -
-
-
Target
$PLUGINSDIR/newadvsplash.dll
-
Size
8KB
-
MD5
55a723e125afbc9b3a41d46f41749068
-
SHA1
01618b26fec6b8c6bdb866e6e4d0f7a0529fe97c
-
SHA256
0a70cc4b93d87ecd93e538cfbed7c9a4b8b5c6f1042c6069757bda0d1279ed06
-
SHA512
559157fa1b3eb6ae1f9c0f2c71ccc692a0a0affb1d6498a8b8db1436d236fd91891897ac620ed5a588beba2efa43ef064211a7fcadb5c3a3c5e2be1d23ef9d4c
-
SSDEEP
96:/VV0Rwtvrm2nQujIvP9dir3UniV/zRzVR3rN3k8Jd18tsPcaqhx:/VV0KtC2yH9d83BzVR53kEQFaq
Score3/10 -
-
-
Target
$PLUGINSDIR/newtextreplace.dll
-
Size
11KB
-
MD5
b5358341df2cb171876a5f201e31a834
-
SHA1
df34750ea5504274be5ff8ddd306b49e302d04f9
-
SHA256
156b9b583399faf13c4d46b89339fb0f7f38dc847ac2d7872178d8e3998b9734
-
SHA512
821dc42e24fa2d44a1d4d16b26c3da2688dac0fa44a266e38da2aff706c91440d83a87abc74131930e6c38a44a0c5e627db2d045375fde147e0edd3276f4b014
-
SSDEEP
192:GGhRfigbU26niqo9m+9k15AA1NrW0QfaDx3nxNLr6s+:GIwgSnhv/IaDx3n6X
Score3/10 -
-
-
Target
$PLUGINSDIR/nsExec.dll
-
Size
6KB
-
MD5
132e6153717a7f9710dcea4536f364cd
-
SHA1
e39bc82c7602e6dd0797115c2bd12e872a5fb2ab
-
SHA256
d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2
-
SHA512
9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1
-
SSDEEP
96:M/SspqrIYxLPEQhThvov3TE4/2Sa5P9QFFYzOx4uF3sbSEI5LP39sQvM:M/QUG7lhvov36S5FcUjliSEI5LuQ
Score3/10 -
-
-
Target
$PLUGINSDIR/registry.dll
-
Size
29KB
-
MD5
2880bf3bbbc8dcaeb4367df8a30f01a8
-
SHA1
cb5c65eae4ae923514a67c95ada2d33b0c3f2118
-
SHA256
acb79c55b3b9c460d032a6f3aaf6c642bf8c1d450e23279d091cc0c6ca510973
-
SHA512
ca978702ce7aa04f8d9781a819a57974f9627e969138e23e81e0792ff8356037c300bb27a37a9b5c756220a7788a583c8e40cc23125bcbe48849561b159c4fa3
-
SSDEEP
768:HsKZwhFkGOr0Ga4+8DFFHR4mmw5+64fuKwX13:HLKmGOr0Ga4+8DFFHRrmw5+m
Score3/10 -