General
-
Target
3e87183a936f145d4b65810e959e47de8832bbcc108fee8ddc350e9fd44287b5
-
Size
552KB
-
Sample
220706-wa1m5afean
-
MD5
afc39b488a7940c95cd7fb68049411d5
-
SHA1
85db9fbdc33ff128dc6d444fc4988af9a7088dce
-
SHA256
3e87183a936f145d4b65810e959e47de8832bbcc108fee8ddc350e9fd44287b5
-
SHA512
170ca840a8dbd7df752d250fd2338f1e333c747f73a07547c84081ea5e376447070d76990c2e1c9be114a94020ece1a4dd1fbfe3d66070f2c5def7ffc9327f7f
Static task
static1
Behavioral task
behavioral1
Sample
3e87183a936f145d4b65810e959e47de8832bbcc108fee8ddc350e9fd44287b5.exe
Resource
win10-20220414-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
cp5ua.hyperhost.ua - Port:
587 - Username:
frankjoelog@valete.buzz - Password:
7213575aceACE@#$ - Email To:
frankjoe@valete.buzz
https://api.telegram.org/bot5321688653:AAEI2yqGrOA_-sRZ3xaqutrexraSgFa0AnA/sendMessage?chat_id=5048077662
Targets
-
-
Target
3e87183a936f145d4b65810e959e47de8832bbcc108fee8ddc350e9fd44287b5
-
Size
552KB
-
MD5
afc39b488a7940c95cd7fb68049411d5
-
SHA1
85db9fbdc33ff128dc6d444fc4988af9a7088dce
-
SHA256
3e87183a936f145d4b65810e959e47de8832bbcc108fee8ddc350e9fd44287b5
-
SHA512
170ca840a8dbd7df752d250fd2338f1e333c747f73a07547c84081ea5e376447070d76990c2e1c9be114a94020ece1a4dd1fbfe3d66070f2c5def7ffc9327f7f
Score10/10-
Snake Keylogger Payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-