General
-
Target
PO-87655.exe
-
Size
709KB
-
Sample
220522-n456psdcep
-
MD5
fc7482c9244e18a9a55aa3705b41e960
-
SHA1
3883c4bae8759a7b9956712f283182cee4d5bb19
-
SHA256
7133536be647a4809ef0e92fc1c0ca8a49db7ed0c79aad39874ae7731bc849b5
-
SHA512
6b0368ce3d40a1f5628b0be452b1bd6bf033608e7f8f74c50ff866521c26d3922a50386fdd28780d07c35a3fec2ba03ab3e9ccdd8478d5b796a94bedc8ebde22
Static task
static1
Behavioral task
behavioral1
Sample
PO-87655.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PO-87655.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
lord.jesus.jesus@yandex.com - Password:
aaccont123 - Email To:
lord.jesus.jesus@yandex.com
Targets
-
-
Target
PO-87655.exe
-
Size
709KB
-
MD5
fc7482c9244e18a9a55aa3705b41e960
-
SHA1
3883c4bae8759a7b9956712f283182cee4d5bb19
-
SHA256
7133536be647a4809ef0e92fc1c0ca8a49db7ed0c79aad39874ae7731bc849b5
-
SHA512
6b0368ce3d40a1f5628b0be452b1bd6bf033608e7f8f74c50ff866521c26d3922a50386fdd28780d07c35a3fec2ba03ab3e9ccdd8478d5b796a94bedc8ebde22
Score10/10-
Snake Keylogger Payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-