Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

d4481a9410...97.exe

windows7-x64

10

d4481a9410...97.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d4481a94108bf7d8fdfa10a7391a3e74ae07665161da4c88ebea81ce7c154597.exe

  • Size

    1.0MB

  • Sample

    250326-td1feszns8

  • MD5

    a5d4c6d1f4fcb9da2faf9b6a4852ef10

  • SHA1

    32c8968b7f96778007f9b713f44ea7aa4439fccf

  • SHA256

    d4481a94108bf7d8fdfa10a7391a3e74ae07665161da4c88ebea81ce7c154597

  • SHA512

    14f3c18a0137570ec45bace1580a81803620602e6f58dc2f2fcf662b2a4550018450dc7404545aa1802eade0a8d1e5b7ed724b806b6b9339b92131dee924b9be

  • SSDEEP

    24576:33HYZWOitFGkKt6vUVFDkhB363y7wwopt5/i6noItfef9q+qF6YaDWt6c:33hOOKt+U8hBqC7wwopt9i6oUAq+qFS0

Score
10/10
guloadercollectiondiscoverydownloaderspywarestealer

Malware Config

Targets

    • Target

      d4481a94108bf7d8fdfa10a7391a3e74ae07665161da4c88ebea81ce7c154597.exe

    • Size

      1.0MB

    • MD5

      a5d4c6d1f4fcb9da2faf9b6a4852ef10

    • SHA1

      32c8968b7f96778007f9b713f44ea7aa4439fccf

    • SHA256

      d4481a94108bf7d8fdfa10a7391a3e74ae07665161da4c88ebea81ce7c154597

    • SHA512

      14f3c18a0137570ec45bace1580a81803620602e6f58dc2f2fcf662b2a4550018450dc7404545aa1802eade0a8d1e5b7ed724b806b6b9339b92131dee924b9be

    • SSDEEP

      24576:33HYZWOitFGkKt6vUVFDkhB363y7wwopt5/i6noItfef9q+qF6YaDWt6c:33hOOKt+U8hBqC7wwopt9i6oUAq+qFS0

    Score
    10/10
    guloaderdiscoverydownloadercollectionspywarestealer

    • Guloader family

      guloader

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      564bb0373067e1785cba7e4c24aab4bf

    • SHA1

      7c9416a01d821b10b2eef97b80899d24014d6fc1

    • SHA256

      7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5

    • SHA512

      22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472

    • SSDEEP

      192:nenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBDIwL:n8+Qlt70Fj/lQRY/9VjjfL

    Score
    3/10
    discovery
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks