Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
PO202501F.exe
-
Size
2.8MB
-
Sample
250116-y55axaxrfn
-
MD5
0dd5014d304efb43d1ad1e58c746b96c
-
SHA1
01eb15c06ec35175e23c079d02ec27806bdc5580
-
SHA256
70fccd712c0675bda276231e600928b9a3bda595719e95adc5fb2b847b156bf9
-
SHA512
e9344b3aaa9cb5961b3dd8ae145c7dabbbb96104292ee9a9ed0e8ad4e0573c4446ea36568c4b2ca88a244fb5d299a4e549c086ab9faca5ba777ad6831620c7c2
-
SSDEEP
12288:pub1M1KYjZUnVZdAAaRgsYakHc5pgHApi3yQsXu/CV7O:pubi1DIDAVRgsSHsgHAhQsVV7O
Static task
static1
Behavioral task
behavioral1
Sample
PO202501F.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
PO202501F.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot7965348925:AAGe8wdrvk9A3lxr1GIjGigodJ_zZ7prhfs/sendMessage?chat_id=6848903538
Targets
-
-
Target
PO202501F.exe
-
Size
2.8MB
-
MD5
0dd5014d304efb43d1ad1e58c746b96c
-
SHA1
01eb15c06ec35175e23c079d02ec27806bdc5580
-
SHA256
70fccd712c0675bda276231e600928b9a3bda595719e95adc5fb2b847b156bf9
-
SHA512
e9344b3aaa9cb5961b3dd8ae145c7dabbbb96104292ee9a9ed0e8ad4e0573c4446ea36568c4b2ca88a244fb5d299a4e549c086ab9faca5ba777ad6831620c7c2
-
SSDEEP
12288:pub1M1KYjZUnVZdAAaRgsYakHc5pgHApi3yQsXu/CV7O:pubi1DIDAVRgsSHsgHAhQsVV7O
Score10/10-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-