Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

AWB_131-39...XE.exe

windows7-x64

3

AWB_131-39...XE.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AWB_131-398896.EXE.exe

  • Size

    420KB

  • Sample

    221018-jvzkcafac7

  • MD5

    6a1da32c021c78395cc87198f064e502

  • SHA1

    c3503b4f9ef992a4b4f8425f345df21d010bbbf4

  • SHA256

    dd4ef3bf2fb18ff2ee31bdf44ca59a037f2c84ad8e7f128f2c56962c37b9a2fb

  • SHA512

    f8459cb1f382586d3342275971e8a7192627d607426ceb1d1cdbfdb0b8fa409bde6de7b0d4541da291c2d177a4bc66131e23feead0e9bc73ac5d50ebf66e265e

  • SSDEEP

    6144:Mv3LGr9Esetmc+wuSZzEUGf9l2bXDGPuEPs8I1AMlSMwBGXfLgwRUjHUz:M/LCygx9SZsfj+ZEPP8AMYMwBGzgGU

Score
10/10
snakekeyloggercollectionkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      AWB_131-398896.EXE.exe

    • Size

      420KB

    • MD5

      6a1da32c021c78395cc87198f064e502

    • SHA1

      c3503b4f9ef992a4b4f8425f345df21d010bbbf4

    • SHA256

      dd4ef3bf2fb18ff2ee31bdf44ca59a037f2c84ad8e7f128f2c56962c37b9a2fb

    • SHA512

      f8459cb1f382586d3342275971e8a7192627d607426ceb1d1cdbfdb0b8fa409bde6de7b0d4541da291c2d177a4bc66131e23feead0e9bc73ac5d50ebf66e265e

    • SSDEEP

      6144:Mv3LGr9Esetmc+wuSZzEUGf9l2bXDGPuEPs8I1AMlSMwBGXfLgwRUjHUz:M/LCygx9SZsfj+ZEPP8AMYMwBGzgGU

    Score
    10/10
    snakekeyloggercollectionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks