Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    1dbfa2e56e9d4dee56960ed3d29ef0423a9301d20f43998f3ecbe21222686c92

  • Size

    691KB

  • Sample

    250325-wrd6fszxav

  • MD5

    ffa6acba3dc763188cc87a98935169bc

  • SHA1

    f0af42999250c066e31739a55cf48bbe839bc1a8

  • SHA256

    1dbfa2e56e9d4dee56960ed3d29ef0423a9301d20f43998f3ecbe21222686c92

  • SHA512

    54ba7b72196470b31fa0050610ca44ce354b4c67c741ff85f876eababf2bfbfabbd0536d6a3b472c7b4fe2db4bc1a79f049787c7e2de04145d4734dee2c91477

  • SSDEEP

    12288:+Ir71pxIbMpsIHZ3B9D/1DD3ZM0Z8qNrdzPFC5sSQ+ymcDguZkxZgUQC1MWzwe:nV71/jZ8gUG+MguezgUMW0e

Malware Config

Extracted

Family

vipkeylogger

Credentials

Targets

    • Target

      orden de compra urgente 57634.exe

    • Size

      864KB

    • MD5

      7b02970d645f97da4d67a4bcd8696f0f

    • SHA1

      72886ef68f5f59b50dc1f6d7e49bd2b598372ea9

    • SHA256

      78f62280687f1306d1b99e72d2a89e928b640cb5b46699a0f51897a77237d216

    • SHA512

      5c0384f38d01ad26169563781c76c73d6aaf784d12dfd4c80f9f251f00461327bb42910263608a10055455902481aae85fb26b1f481664cc9912efb6159744cf

    • SSDEEP

      12288:idQMYyOn6nzxxp/YRbryJClPNHfViozW4i6CSE+ymcDwuZkTZEUivBMpkR:KY9n6nzpCbr6MN/cYW4it+MwuedO1

    • VIPKeylogger

      VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    • Vipkeylogger family

    • Accesses Microsoft Outlook profiles

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks