Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    e1e2aee32291f37aa9d4f220c99f4d3cff3d95dd3f5802e5d8acc119f875e8aa.rar

  • Size

    16KB

  • Sample

    240927-caewwasbja

  • MD5

    53d082ce28feba3729c2f565bcbee55e

  • SHA1

    d4ab01915ce1d6528e208f349d2b06ee002f4c37

  • SHA256

    e1e2aee32291f37aa9d4f220c99f4d3cff3d95dd3f5802e5d8acc119f875e8aa

  • SHA512

    e9063672bddf61109f8e8d8c9e23c54d2b93b1e0848946451531171be73d4e62f46fd9e72a22b42860a7fcd6458c9462d44bf552b0c68859f887d414c949c7fb

  • SSDEEP

    384:DUrVK8eH8ai1CDL2mDBzxow7ZInvzO/A/IJ79DryAth0UnZy:eAH6YLTzrwvzIBhrZUGQ

Malware Config

Extracted

Family

snakekeylogger

C2

https://api.telegram.org/bot7898897232:AAH4QekZK0wf1eNHt5yAECTe9huaiVIg5vE/sendMessage?chat_id=5726609491

Targets

    • Target

      RFQ____RM quotation_JPEG IMAGE.img.exe

    • Size

      34KB

    • MD5

      c3490999b5e36705b9b2abb2a3ed08c1

    • SHA1

      f6af8f800b5e86d12ea5a1a5567da493d0c816b3

    • SHA256

      8f2dd3233b7b97265bcdfc1053875652d9f9012d3716de034f73b5caadd78d7b

    • SHA512

      4e0fac9aa28dba4129e1c35ccb14a2cde1562d62f3fd920f490cc28b1c875df54911dc497c5748772dcf3f06a33f68ce9a87ebd1c7df585c05a1c952635531a8

    • SSDEEP

      768:hv2b4c1Jq7JN32aZzxya2sKE0HMN6G8jrWz0hsg4spg+:h0457JNHosn0GAvWz0uxB+

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

    • Snake Keylogger payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks