General
-
Target
RFQ pdf.exe
-
Size
782KB
-
Sample
220923-gxl1xshccp
-
MD5
2186990b3fc8fb51de0d235276613505
-
SHA1
5e8223137622466c1eca35271586dd6824fb5b1c
-
SHA256
e2d1f7e5fe7da6323d2b8105d8aabfbcaf21603059a05c263e14cc079b371718
-
SHA512
286be9e8f8d181db4a032f97a8973a482fbbe6a57248a7d9bea616b22c9610a47ab5c084ca38da387a354419da81edca909fcab8e1ab0a99a4654ba148ba7146
-
SSDEEP
12288:Uw1SnEwn5B2aUNLTo9XUxIcZg47GV8Z9U:6nEwnr2JLT4X+yyGmZ
Static task
static1
Behavioral task
behavioral1
Sample
RFQ pdf.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
RFQ pdf.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5149109129:AAGFSJSlChXwgqfifOahBX2gfNaVHTpF5Mk/sendMessage?chat_id=2014219704
Targets
-
-
Target
RFQ pdf.exe
-
Size
782KB
-
MD5
2186990b3fc8fb51de0d235276613505
-
SHA1
5e8223137622466c1eca35271586dd6824fb5b1c
-
SHA256
e2d1f7e5fe7da6323d2b8105d8aabfbcaf21603059a05c263e14cc079b371718
-
SHA512
286be9e8f8d181db4a032f97a8973a482fbbe6a57248a7d9bea616b22c9610a47ab5c084ca38da387a354419da81edca909fcab8e1ab0a99a4654ba148ba7146
-
SSDEEP
12288:Uw1SnEwn5B2aUNLTo9XUxIcZg47GV8Z9U:6nEwnr2JLT4X+yyGmZ
Score10/10-
Snake Keylogger payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-