Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

INQ-2022-0...90.exe

windows7-x64

10

INQ-2022-0...90.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    INQ-2022-09-21-AQI3N847211-INQ0290.exe

  • Size

    931KB

  • Sample

    220921-f9e8gafcd6

  • MD5

    89116b990a62888ca7a5954fe8379519

  • SHA1

    fe19acb68f0a658d817eb65da912829401bb940b

  • SHA256

    b2b8c1c6f1b2f3765741c727f9b9995427669b972992e319522ad730201c6ea5

  • SHA512

    95bd82d193d2d48b9ea54334faba1ec1a681e79c08064a38905d1286c3a2327d2d910a3e2e04f7cdadbb548ba7cb8bfb97440c2fa9e4bddc4c9fe8dbf39123fd

  • SSDEEP

    12288:VcDL71G/fqBbLBWO5cb3JsgGEps3Mtn54TUa1f8edAY:2Df16fqtBub32qs+5va1Ndh

Score
10/10
snakekeyloggercollectionkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot5453475689:AAEPtYkTq-8THTeKrYW8b68w6CGTVgKvmpM/sendMessage?chat_id=5798274961

Targets

    • Target

      INQ-2022-09-21-AQI3N847211-INQ0290.exe

    • Size

      931KB

    • MD5

      89116b990a62888ca7a5954fe8379519

    • SHA1

      fe19acb68f0a658d817eb65da912829401bb940b

    • SHA256

      b2b8c1c6f1b2f3765741c727f9b9995427669b972992e319522ad730201c6ea5

    • SHA512

      95bd82d193d2d48b9ea54334faba1ec1a681e79c08064a38905d1286c3a2327d2d910a3e2e04f7cdadbb548ba7cb8bfb97440c2fa9e4bddc4c9fe8dbf39123fd

    • SSDEEP

      12288:VcDL71G/fqBbLBWO5cb3JsgGEps3Mtn54TUa1f8edAY:2Df16fqtBub32qs+5va1Ndh

    Score
    10/10
    snakekeyloggercollectionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks