Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    Shipping Documents.pdf.exe

  • Size

    955KB

  • Sample

    230702-g4wtpsah24

  • MD5

    942bae42d55b0f96f3b71d4615ceade1

  • SHA1

    ab228e994517f9172791fc811af5c7d97feeb62b

  • SHA256

    7f01e18e55c703b1a21ec0f57483da3de9d5565ce3e440028d40cf553977a101

  • SHA512

    f0ff10f52c474157bf5d53673ec929d67aee9cf325e97cc53800e2cd0ec2e2fabe7662c9d8b5d86f08bb4444d201e5ea0e45a79946faa0c28b05703d96beb205

  • SSDEEP

    12288:hxBk76hehkkhj63DlY7E3RbHN1Hn9+xUkU07O8R:hxuvXj6h3RN1HfkF7n

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot5869504375:AAFm1Z7IkZTyjASpoFpmokA0jISwF8dTPE0/sendMessage?chat_id=6033043077

Targets

    • Target

      Shipping Documents.pdf.exe

    • Size

      955KB

    • MD5

      942bae42d55b0f96f3b71d4615ceade1

    • SHA1

      ab228e994517f9172791fc811af5c7d97feeb62b

    • SHA256

      7f01e18e55c703b1a21ec0f57483da3de9d5565ce3e440028d40cf553977a101

    • SHA512

      f0ff10f52c474157bf5d53673ec929d67aee9cf325e97cc53800e2cd0ec2e2fabe7662c9d8b5d86f08bb4444d201e5ea0e45a79946faa0c28b05703d96beb205

    • SSDEEP

      12288:hxBk76hehkkhj63DlY7E3RbHN1Hn9+xUkU07O8R:hxuvXj6h3RN1HfkF7n

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

    • Snake Keylogger payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks