Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
abc34aec9a45b5f5da9b10738ea2f5efcd7a15c30c02ba68e5f19b101b552158
-
Size
571KB
-
Sample
240417-rrthxsbg88
-
MD5
087087b333dd1626c8cbca671b85c17b
-
SHA1
12f204f751335f893cf20a9df9fc806a36095eb3
-
SHA256
abc34aec9a45b5f5da9b10738ea2f5efcd7a15c30c02ba68e5f19b101b552158
-
SHA512
0ea87c55d2315b6b26ce2d352b1fc89130d7ac5b47c5f5600c35ec3217fd5b67b5e7ba1d35f444d5d7d46c98d912f154e4ff4f70f0f9056dce3c2058a34f1f25
-
SSDEEP
12288:KKo3v3VRuCVTpr3VmwbUpCsJ/hihyhRgLP48FJ99gAb1OtuTeU:Knf3KYTpr3VmwY9hi8haTFJ9lstuv
Static task
static1
Behavioral task
behavioral1
Sample
708ee4218d5907976919dff1722a69fe187648dcf3503a1544d822871a91fad2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
708ee4218d5907976919dff1722a69fe187648dcf3503a1544d822871a91fad2.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.viajescoriatours.com - Port:
587 - Username:
[email protected] - Password:
170717FteoS% - Email To:
[email protected]
http://varders.kozow.com:8081
http://aborters.duckdns.org:8081
http://anotherarmy.dns.army:8081
Targets
-
-
Target
708ee4218d5907976919dff1722a69fe187648dcf3503a1544d822871a91fad2.exe
-
Size
855KB
-
MD5
69bbd35257d7603e97cddf814542ae3b
-
SHA1
1b7fbdc11e81366d54b812bc9e165c9ed384f226
-
SHA256
708ee4218d5907976919dff1722a69fe187648dcf3503a1544d822871a91fad2
-
SHA512
8b8a62cf53d3cf3f89fbdca65f5e59f1844f2d96771172850634ef0c1cd53bafdb4c96fcd21d42f061e5686ffc3d5ebaec52a27a1f79abb350d727528efc601a
-
SSDEEP
24576:ZTs8rLXJu1AFEwddHeWt+ZgUYeKaD8YynlF9D:ZTTLY1AFEwDHeAwtYeKa4YynlF9
Score10/10-
Snake Keylogger payload
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-