General
-
Target
294626d8329542cdcadaf4342bbb99fb.exe
-
Size
672KB
-
Sample
220930-sha6naeggk
-
MD5
294626d8329542cdcadaf4342bbb99fb
-
SHA1
74133bf73f2bd4d61d4794efeddc8a68ca3cb626
-
SHA256
e94981ca0da699cd4c54ceae54a7f713ca999003aa5fd023aa8fa94707877f6e
-
SHA512
bdafd1706c24c4908bfccd3840724689a44253359d8af353f60eac902474e6d77a4c9145566f08d3a33dd4ae10dbc33d3c6c4186ed017d7e3a4f00d0c7d94943
-
SSDEEP
12288:UtNeFhdYSfYgPr3vmKygjR4uoKrnEdxt8D87Owt6:GNeFXzQWrtR4ukQkt6
Static task
static1
Behavioral task
behavioral1
Sample
294626d8329542cdcadaf4342bbb99fb.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
294626d8329542cdcadaf4342bbb99fb.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
doDHyw%0 - Email To:
[email protected]
Targets
-
-
Target
294626d8329542cdcadaf4342bbb99fb.exe
-
Size
672KB
-
MD5
294626d8329542cdcadaf4342bbb99fb
-
SHA1
74133bf73f2bd4d61d4794efeddc8a68ca3cb626
-
SHA256
e94981ca0da699cd4c54ceae54a7f713ca999003aa5fd023aa8fa94707877f6e
-
SHA512
bdafd1706c24c4908bfccd3840724689a44253359d8af353f60eac902474e6d77a4c9145566f08d3a33dd4ae10dbc33d3c6c4186ed017d7e3a4f00d0c7d94943
-
SSDEEP
12288:UtNeFhdYSfYgPr3vmKygjR4uoKrnEdxt8D87Owt6:GNeFXzQWrtR4ukQkt6
Score10/10-
Snake Keylogger payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-