Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

req_installer.exe

windows11-21h2-x64

7

Creal.pyc

windows11-21h2-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    req_installer.exe

  • Size

    10.5MB

  • Sample

    250310-y55lnsxxax

  • MD5

    5a6077a399e8171f76653aab7e236bd8

  • SHA1

    84c45bf20a882eda1145d197ded2060af73260be

  • SHA256

    348cd77684a19409bca9803d5a7c29b8a79b0f902ea3866c225cdc4c15d74e22

  • SHA512

    82cd8f395548ad26060ae8cd927e3dfb3f27a8f962fe3c735911caeee3f5f362ccb9670d047f428c0aa48767302e44611ece854681285f14cb2af08e92a49955

  • SSDEEP

    196608:wliIE7SRpozaH7DkhtL2Vmd6+D0JJVAzDaku9QFzFdH8EQGCfkF6Lhy1f:uiIE7Yo2HvGL2Vmd6m0JJVAzDakhFznL

Score
10/10
crealstealercredential_accessdiscoverypyinstallerspywarestealer

Malware Config

Targets

    • Target

      req_installer.exe

    • Size

      10.5MB

    • MD5

      5a6077a399e8171f76653aab7e236bd8

    • SHA1

      84c45bf20a882eda1145d197ded2060af73260be

    • SHA256

      348cd77684a19409bca9803d5a7c29b8a79b0f902ea3866c225cdc4c15d74e22

    • SHA512

      82cd8f395548ad26060ae8cd927e3dfb3f27a8f962fe3c735911caeee3f5f362ccb9670d047f428c0aa48767302e44611ece854681285f14cb2af08e92a49955

    • SSDEEP

      196608:wliIE7SRpozaH7DkhtL2Vmd6+D0JJVAzDaku9QFzFdH8EQGCfkF6Lhy1f:uiIE7Yo2HvGL2Vmd6m0JJVAzDakhFznL

    Score
    7/10
    credential_accessdiscoveryspywarestealer

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Enumerates processes with tasklist

      discovery
    behavioral1

    • Target

      Creal.pyc

    • Size

      29KB

    • MD5

      3656b61524347e918b34a9c3b166c0b0

    • SHA1

      c11ee62127d2385972da554de89a4dd7fa0ed5f7

    • SHA256

      fcbade0c4918fad35d7b25b1988b16dad54af080cacdea831fcca9b5292b682a

    • SHA512

      49d21c55511d05ed11d2e03cd429d75acf3e7364224df2e6f1ce3f91d700f408b475e1565e27dad801b81d0ee1bd92787781e18ddab74f1935e75c49fb1af4e5

    • SSDEEP

      768:+trcnricCuKa/IdcxVETeAFpK5Dha4tWcpuKGPCg:GSrYO/J2vY5DAVy587

    Score
    3/10
    behavioral2

MITRE ATT&CK Enterprise v15

Tasks