Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
a27e182b447fdf32f2e0121f92cce6c426d133d239fb7de64e6ca773e5050b85.ace
-
Size
617KB
-
Sample
240706-b3al7asbjn
-
MD5
5dbf1ac07fcffb9a70963388b98982f6
-
SHA1
4d1bb3d3f1b35b20d68e60ab437477c2d8972e45
-
SHA256
a27e182b447fdf32f2e0121f92cce6c426d133d239fb7de64e6ca773e5050b85
-
SHA512
c5f03431918956b2e216a2e86e7c6523cfc161d610c2101e7ca8611769c908bf75ccbe2f920a5f0374ee2d0f49e57a88f6b53dacfaf51a79375454dae69d4499
-
SSDEEP
12288:16EaKBk3hnL4ZcHo3gi1XT9Tv0yoFBE5I3dDkSVvcE6uMy:oEaKuhLEcIQwXT9TvB8BE5IplVUE6U
Static task
static1
Behavioral task
behavioral1
Sample
Payment Copy.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Payment Copy.exe
Resource
win10v2004-20240704-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
smtp.innovativeenqg.co.in - Port:
25 - Username:
[email protected] - Password:
%OTz$v%9 - Email To:
[email protected]
Targets
-
-
Target
Payment Copy.exe
-
Size
740KB
-
MD5
eb3d064d6075848f9477f4babd34ee6a
-
SHA1
168e2497e77fae7de19e89458b33acc32371d905
-
SHA256
6cfb5c2cba6ba8911866c3391977ab0c518c3154c749c5fea23a135488931e32
-
SHA512
c7a25725bc5c5737aa59528aa7a1a52d35effb4175cf3afac6a515e9be7cd3b6993e041c184ce03d1a588da6141b216f1a095817dea0adfbc2cbc9c6234fcfa0
-
SSDEEP
12288:gRtsaKRa5x6pZEZNr49YEtE63vRBksE3/Na+sxcgxmn52hREYuzlVr:7k5kLEZNXWZ3ZMhNn52YPR
Score10/10-
Snake Keylogger payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-