General
-
Target
162a7cc38d23c7375e5d5d9c28051c43.exe
-
Size
1.5MB
-
Sample
210118-8tyv3z7f6j
-
MD5
162a7cc38d23c7375e5d5d9c28051c43
-
SHA1
981534f63e2f386cbc0c8f6f06c85652748c2185
-
SHA256
485fcb629691d08260b4066b1261fefbbdd4dd399fb5ebf9df7311c5e0710f68
-
SHA512
2ade29cd1b5b63896431205b33d38bbfc63441ee1b0e6cf992e9189a62c308ebd5b343606f68859c1a092ddb33ccbe99f1a8f6a1589d69f5a1c1f0b0a56f773c
Static task
static1
Behavioral task
behavioral1
Sample
162a7cc38d23c7375e5d5d9c28051c43.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
162a7cc38d23c7375e5d5d9c28051c43.exe
Resource
win10v20201028
Malware Config
Targets
-
-
Target
162a7cc38d23c7375e5d5d9c28051c43.exe
-
Size
1.5MB
-
MD5
162a7cc38d23c7375e5d5d9c28051c43
-
SHA1
981534f63e2f386cbc0c8f6f06c85652748c2185
-
SHA256
485fcb629691d08260b4066b1261fefbbdd4dd399fb5ebf9df7311c5e0710f68
-
SHA512
2ade29cd1b5b63896431205b33d38bbfc63441ee1b0e6cf992e9189a62c308ebd5b343606f68859c1a092ddb33ccbe99f1a8f6a1589d69f5a1c1f0b0a56f773c
Score10/10-
Snake Keylogger Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-