Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

3b374dfe1f...15.exe

windows7-x64

10

3b374dfe1f...15.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3b374dfe1fe2e394e0fafabbc72fc215

  • Size

    511KB

  • Sample

    231231-2bd4eahgc2

  • MD5

    3b374dfe1fe2e394e0fafabbc72fc215

  • SHA1

    e0a6bcf7ba2dede3262cb1924ed59b8254dcbb2f

  • SHA256

    6db83cda6f33d2cbc17c264e8526d0ad4039ef9cf8f50b7c378b86d1d5a074ed

  • SHA512

    fec3bad431fc014b961d239cd4ec79644989e34d2e03cad874ae79c269dc5e7a560730a27079d9ccf578cfb12ee2531a0ff967fb471096c2dcb8621c8ef23041

  • SSDEEP

    12288:Xo9XY/GaSyb9EUHIfuM101SqO/tiT4ED7x+74JWHTx8PqyY6hj+ihXIu5l:/7fELu2gWRI

Score
10/10
snakekeyloggerzgratkeyloggerratstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

Targets

    • Target

      3b374dfe1fe2e394e0fafabbc72fc215

    • Size

      511KB

    • MD5

      3b374dfe1fe2e394e0fafabbc72fc215

    • SHA1

      e0a6bcf7ba2dede3262cb1924ed59b8254dcbb2f

    • SHA256

      6db83cda6f33d2cbc17c264e8526d0ad4039ef9cf8f50b7c378b86d1d5a074ed

    • SHA512

      fec3bad431fc014b961d239cd4ec79644989e34d2e03cad874ae79c269dc5e7a560730a27079d9ccf578cfb12ee2531a0ff967fb471096c2dcb8621c8ef23041

    • SSDEEP

      12288:Xo9XY/GaSyb9EUHIfuM101SqO/tiT4ED7x+74JWHTx8PqyY6hj+ihXIu5l:/7fELu2gWRI

    Score
    10/10
    snakekeyloggerzgratkeyloggerratstealer

    • Detect ZGRat V1

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger payload

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks