General
-
Target
tmp
-
Size
740KB
-
Sample
220923-g8clmaddb5
-
MD5
d94e6d2a099ee896488b28452eb0d5f0
-
SHA1
19db83582d45a71d83a162ed2fc90b3af5422051
-
SHA256
b1e886e95c76a7a0dccc3d15bc383bc4e87ec8b8d37e83d77c12b139d57e6d9f
-
SHA512
866460f614a17aadade0e5fd01ad3a8fa9eee0f0c578bc5fdfe7452020201df06626ac6b0fbe6f99fc8d5b6a6882088dea0379c960f8a969185d39d5ca40859d
-
SSDEEP
12288:KBeNQD0LJU2WV0388JjsT6h2YZypOArL2I5:KBR2esjmO2YZ2Br5
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
feritkalafatoglu@frem-tr.com - Password:
LYSV$*b4 - Email To:
feritkalafatoglu@frem-tr.com
Targets
-
-
Target
tmp
-
Size
740KB
-
MD5
d94e6d2a099ee896488b28452eb0d5f0
-
SHA1
19db83582d45a71d83a162ed2fc90b3af5422051
-
SHA256
b1e886e95c76a7a0dccc3d15bc383bc4e87ec8b8d37e83d77c12b139d57e6d9f
-
SHA512
866460f614a17aadade0e5fd01ad3a8fa9eee0f0c578bc5fdfe7452020201df06626ac6b0fbe6f99fc8d5b6a6882088dea0379c960f8a969185d39d5ca40859d
-
SSDEEP
12288:KBeNQD0LJU2WV0388JjsT6h2YZypOArL2I5:KBR2esjmO2YZ2Br5
Score10/10-
Snake Keylogger payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-