General
-
Target
PO-283230701.exe
-
Size
1023KB
-
Sample
221002-n4kvrsfdfm
-
MD5
fe68f51d91571978c10d2566cab6c75a
-
SHA1
188cc0ae9c582f858cd8952ffb29c16c4374c524
-
SHA256
7768c1da766d45e917871231c3b6ad5d890cb5d363e805ea58b8a8c96d206d20
-
SHA512
005d5b6ad79bf77e3ddd4b168307ba6ff4a7bd6d89b5761829880b980f7b5a290acb646a87e326db024b74f937dd53c6ff089e88e1d552f3b40e0e8d010d3a56
-
SSDEEP
12288:HZc2iNUAH/QhugseSqyq1AvKyCRuJRomBJElrMGD9DBTzw1ZOP632TD7:5c1AugszNKP5cpJMrRDBTzAIPnD7
Static task
static1
Behavioral task
behavioral1
Sample
PO-283230701.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
PO-283230701.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5688807535:AAG1DGE6pZTsXCmSWLJMEc1Gjb9GWweDx4E/sendMessage?chat_id=5567956038
Targets
-
-
Target
PO-283230701.exe
-
Size
1023KB
-
MD5
fe68f51d91571978c10d2566cab6c75a
-
SHA1
188cc0ae9c582f858cd8952ffb29c16c4374c524
-
SHA256
7768c1da766d45e917871231c3b6ad5d890cb5d363e805ea58b8a8c96d206d20
-
SHA512
005d5b6ad79bf77e3ddd4b168307ba6ff4a7bd6d89b5761829880b980f7b5a290acb646a87e326db024b74f937dd53c6ff089e88e1d552f3b40e0e8d010d3a56
-
SSDEEP
12288:HZc2iNUAH/QhugseSqyq1AvKyCRuJRomBJElrMGD9DBTzw1ZOP632TD7:5c1AugszNKP5cpJMrRDBTzAIPnD7
Score10/10-
Snake Keylogger payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-