General
-
Target
doc20200909748366486636386373.exe
-
Size
580KB
-
Sample
220704-h68fyshdc6
-
MD5
d390f0baa9542dc888b527d35dfa7e7b
-
SHA1
067ccfbacf1dc116d01597fb4b54be9625c153a2
-
SHA256
3d818ee91ac4a1f901f705a8a118303ce6d86de59b54911fc00565f1b8a8f114
-
SHA512
50aa8a868a17a4b1e6c3243818af203540b7d9028c628847ce3c1896c4ce49274dc7dda3f345cac225cdd998dfad6143784692ff4d8fed860837c1bae320b4c4
Static task
static1
Behavioral task
behavioral1
Sample
doc20200909748366486636386373.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
doc20200909748366486636386373.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5468731092:AAGGNQWBVRhX622u6xp1moMhaunIGtXuIxg/sendMessage?chat_id=1639214896
Targets
-
-
Target
doc20200909748366486636386373.exe
-
Size
580KB
-
MD5
d390f0baa9542dc888b527d35dfa7e7b
-
SHA1
067ccfbacf1dc116d01597fb4b54be9625c153a2
-
SHA256
3d818ee91ac4a1f901f705a8a118303ce6d86de59b54911fc00565f1b8a8f114
-
SHA512
50aa8a868a17a4b1e6c3243818af203540b7d9028c628847ce3c1896c4ce49274dc7dda3f345cac225cdd998dfad6143784692ff4d8fed860837c1bae320b4c4
Score10/10-
Snake Keylogger Payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-