General
-
Target
PO#4500373371.exe
-
Size
1.2MB
-
Sample
221003-jptf5sfdcr
-
MD5
bf6a7dc3802e1021b909bf75128ce4d5
-
SHA1
23ab4bc2684f1bd382ec648b4c0e86ce781f4c6c
-
SHA256
4c743eaedbc97613e8759c49e069f872bc786187cb2975a9564ab0aec2cd2205
-
SHA512
ae1559235888edc63227c6a0b0bd1306b23da5e18d79082c63b3cd2cc4366b36b0ca549282ec9df2c671b03524563873870f86d85c347999275dfa14261b8e3c
-
SSDEEP
12288:Vr4bOPr1Ytui7JztmJ/Q5foZqgZMwR1urkwOBq6WT8dWpedJRg1K4HTN:R4MedtoUAzHR10MBqrT86eL
Static task
static1
Behavioral task
behavioral1
Sample
PO#4500373371.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
PO#4500373371.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5587666659:AAG8NrrXJQs__dhk8nLJBFOspz2my8OVpX0/sendMessage?chat_id=5569775004
Targets
-
-
Target
PO#4500373371.exe
-
Size
1.2MB
-
MD5
bf6a7dc3802e1021b909bf75128ce4d5
-
SHA1
23ab4bc2684f1bd382ec648b4c0e86ce781f4c6c
-
SHA256
4c743eaedbc97613e8759c49e069f872bc786187cb2975a9564ab0aec2cd2205
-
SHA512
ae1559235888edc63227c6a0b0bd1306b23da5e18d79082c63b3cd2cc4366b36b0ca549282ec9df2c671b03524563873870f86d85c347999275dfa14261b8e3c
-
SSDEEP
12288:Vr4bOPr1Ytui7JztmJ/Q5foZqgZMwR1urkwOBq6WT8dWpedJRg1K4HTN:R4MedtoUAzHR10MBqrT86eL
Score10/10-
Snake Keylogger payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-