General
-
Target
snake.exe
-
Size
609KB
-
Sample
210623-gmj6587vm6
-
MD5
6359928b0db9c3986524b32d065a6ca7
-
SHA1
ccb9a66a122031aed3fac72b076bb6f09dcb54ab
-
SHA256
c3773b3eec40de054099cab333c06b4502b9343aae95ee7d3120d42fb12bfd46
-
SHA512
f778a5a6eac05c5c60e6ff6089280e1548b9959c394fd91db3cfa339084b3f5d3924637e2129e07c04f8d669669255c41f3f6544a3f9e7513cf84dad8abeb619
Static task
static1
Behavioral task
behavioral1
Sample
Minutes of Meeting.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Minutes of Meeting.exe
Resource
win10v20210408
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.iykmoreentrprise.org - Port:
587 - Username:
zalatexinteriors@iykmoreentrprise.org - Password:
Z&6s7s.YLZZi
Targets
-
-
Target
Minutes of Meeting.exe
-
Size
1.0MB
-
MD5
eac5c6f21e77b72411042ffa77a1e518
-
SHA1
2ceb0743bb87dcf356594dce6d80729b9f813f9f
-
SHA256
9cb54681b585020ef5deef74c4fc2772529d1d0a908e5da4afa751368779aba1
-
SHA512
008221a65530a1155adf9241fc509cbc0016606aead245ebb10cd4cc7edb13c1518020f9dc6f08547dc19ed317b585430bf92bc081668f3a4af8a9c9122d0a74
Score10/10-
Snake Keylogger Payload
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-