General
-
Target
3ae917821f25ac269e4f1b67cb08254e.exe
-
Size
714KB
-
Sample
221002-hmgtwscfd2
-
MD5
3ae917821f25ac269e4f1b67cb08254e
-
SHA1
cbf9e24748b03a678f091bcc3ff08c8ab0e53706
-
SHA256
ea8c1f7cd78519ad333b1125813fa58ada79944f3dd39d0b059f32ed77a333eb
-
SHA512
ee5949d281eec67bd28dad604f5bb0ed989d0a5bda450b8eaef5fd86b02acfa1cfe4e18c7637705b498cf9a872166b0e71cfbdb48d764ca0b2ad599039ecd86e
-
SSDEEP
12288:wiBrZ1pcAxtGhZn558K4ZcUWfHaf+yiIbkV81BjMP:B7pcAxtGhx5GZO6PKshW
Static task
static1
Behavioral task
behavioral1
Sample
3ae917821f25ac269e4f1b67cb08254e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3ae917821f25ac269e4f1b67cb08254e.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot1792089002:AAEPhaOGVcmGnS9wbcudlAWVztyQs4en3nU/sendMessage?chat_id=1155456627
Targets
-
-
Target
3ae917821f25ac269e4f1b67cb08254e.exe
-
Size
714KB
-
MD5
3ae917821f25ac269e4f1b67cb08254e
-
SHA1
cbf9e24748b03a678f091bcc3ff08c8ab0e53706
-
SHA256
ea8c1f7cd78519ad333b1125813fa58ada79944f3dd39d0b059f32ed77a333eb
-
SHA512
ee5949d281eec67bd28dad604f5bb0ed989d0a5bda450b8eaef5fd86b02acfa1cfe4e18c7637705b498cf9a872166b0e71cfbdb48d764ca0b2ad599039ecd86e
-
SSDEEP
12288:wiBrZ1pcAxtGhZn558K4ZcUWfHaf+yiIbkV81BjMP:B7pcAxtGhx5GZO6PKshW
Score10/10-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-