Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

PO 732001_pdf.exe

windows7-x64

10

PO 732001_pdf.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO 732001_pdf.exe

  • Size

    710KB

  • Sample

    230209-r282csga7t

  • MD5

    16518717490a9378b8ce9e4398c22bba

  • SHA1

    94199ea9d1227a495d09fc77a63088d25829b022

  • SHA256

    7bcce65d6166d096b69e5cd5e4a1e6a3991ff77aed3495da1af2b4f9ecbeef93

  • SHA512

    c9d94d712ee5039ac8833140fe5e107d87aa12644a411429d21dccf1b18d61fa6c727b04f3238050c18501df20afafdcddf81c554f8e13ac1ce9fdcdbce86522

  • SSDEEP

    12288:/UNSgr0oFGV/nMA1uSx8AevTsff0a8Gt3w8sqz4XRKyghCS09QPi/4mJoHpqf2wt:/UtwfTo1f7wCtxzfJGY

Score
10/10
snakekeyloggercollectionkeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot6010601014:AAE_RJm-2igP99_YnmRQZ_TajH6dCuBx6CI/sendMessage?chat_id=869301167

Targets

    • Target

      PO 732001_pdf.exe

    • Size

      710KB

    • MD5

      16518717490a9378b8ce9e4398c22bba

    • SHA1

      94199ea9d1227a495d09fc77a63088d25829b022

    • SHA256

      7bcce65d6166d096b69e5cd5e4a1e6a3991ff77aed3495da1af2b4f9ecbeef93

    • SHA512

      c9d94d712ee5039ac8833140fe5e107d87aa12644a411429d21dccf1b18d61fa6c727b04f3238050c18501df20afafdcddf81c554f8e13ac1ce9fdcdbce86522

    • SSDEEP

      12288:/UNSgr0oFGV/nMA1uSx8AevTsff0a8Gt3w8sqz4XRKyghCS09QPi/4mJoHpqf2wt:/UtwfTo1f7wCtxzfJGY

    Score
    10/10
    snakekeyloggercollectionkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks