Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
1b1da45c6cff14f498bcae64c81ce606561f6d3035a7af6d3287c30307cd6c6c
-
Size
523KB
-
Sample
221206-y9xrmadg2v
-
MD5
ecca4eea09da608b4d6b44ce878be0d5
-
SHA1
27f13034662582c97b29cb913eecd1f8a76eadc3
-
SHA256
d1a5f6d9d490b082b92ae2c9bee897e196beef96def5c1a46f3cc3a1661614c9
-
SHA512
82f02bd1717e96ac0c6edca44ca460386e4240061e8f52d8d8c3d4364e7c4669a121dfe72278e76873e70ea07987030b056c940ee897a3482c324cfdac52ce54
-
SSDEEP
12288:2+L6gH3nqUcWfkw1hiQ6SnMYMMuEgE/Dr280QR3gMC5s8Ei:2y6c3qUT8w1EQ6yM5xVwH28003H8H
Static task
static1
Behavioral task
behavioral1
Sample
1b1da45c6cff14f498bcae64c81ce606561f6d3035a7af6d3287c30307cd6c6c.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1b1da45c6cff14f498bcae64c81ce606561f6d3035a7af6d3287c30307cd6c6c.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.aquayflores.cl - Port:
587 - Username:
[email protected] - Password:
fLuBfX#l?tQ9 - Email To:
[email protected]
Targets
-
-
Target
1b1da45c6cff14f498bcae64c81ce606561f6d3035a7af6d3287c30307cd6c6c
-
Size
773KB
-
MD5
5ce4a3a94f30e5e84c3ba58de0e9801b
-
SHA1
d5fa09cee1c024f321996b2ca37211055a63800c
-
SHA256
1b1da45c6cff14f498bcae64c81ce606561f6d3035a7af6d3287c30307cd6c6c
-
SHA512
fca822d9ad45ed7ac139926904bb080cc0f940632883ced48b61f2dcf30590381d4e628d75ea28f015160d4ff47f438c549277d6fc5470ce80b9ae4e1b136693
-
SSDEEP
12288:Oc4qUiW1ywJHiG6SnMCo+uEgE/XrlBjmaZgKZ/nXt7virmWhlGLaQYI:l4qU14wJCG6yMt/Vwbb
Score10/10-
Snake Keylogger payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-