Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
RFQ____RM quotation_JPEG IMAGE.img_1.lzh.rar
-
Size
16KB
-
Sample
240926-qszwnazbkq
-
MD5
53d082ce28feba3729c2f565bcbee55e
-
SHA1
d4ab01915ce1d6528e208f349d2b06ee002f4c37
-
SHA256
e1e2aee32291f37aa9d4f220c99f4d3cff3d95dd3f5802e5d8acc119f875e8aa
-
SHA512
e9063672bddf61109f8e8d8c9e23c54d2b93b1e0848946451531171be73d4e62f46fd9e72a22b42860a7fcd6458c9462d44bf552b0c68859f887d414c949c7fb
-
SSDEEP
384:DUrVK8eH8ai1CDL2mDBzxow7ZInvzO/A/IJ79DryAth0UnZy:eAH6YLTzrwvzIBhrZUGQ
Static task
static1
Behavioral task
behavioral1
Sample
RFQ____RM quotation_JPEG IMAGE.img.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
RFQ____RM quotation_JPEG IMAGE.img.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot7898897232:AAH4QekZK0wf1eNHt5yAECTe9huaiVIg5vE/sendMessage?chat_id=5726609491
Targets
-
-
Target
RFQ____RM quotation_JPEG IMAGE.img.exe
-
Size
34KB
-
MD5
c3490999b5e36705b9b2abb2a3ed08c1
-
SHA1
f6af8f800b5e86d12ea5a1a5567da493d0c816b3
-
SHA256
8f2dd3233b7b97265bcdfc1053875652d9f9012d3716de034f73b5caadd78d7b
-
SHA512
4e0fac9aa28dba4129e1c35ccb14a2cde1562d62f3fd920f490cc28b1c875df54911dc497c5748772dcf3f06a33f68ce9a87ebd1c7df585c05a1c952635531a8
-
SSDEEP
768:hv2b4c1Jq7JN32aZzxya2sKE0HMN6G8jrWz0hsg4spg+:h0457JNHosn0GAvWz0uxB+
-
Snake Keylogger payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-