General
-
Target
07e31a5e8c561c60b4a1768f68bd0699db9e5b185f03d6170d735e2b92da1f4e
-
Size
806KB
-
Sample
221003-mklghsgae7
-
MD5
fd9bc712624cfc6075a4b5f58a989462
-
SHA1
afa4d6a3494c364e3f00fc6dba9f931e8ac58276
-
SHA256
07e31a5e8c561c60b4a1768f68bd0699db9e5b185f03d6170d735e2b92da1f4e
-
SHA512
f1e71d874e2843b9599eaa0c7f6b10251b8bca10a637e5cf06dff9c8c5d06ac4b6e00cad93c58ed47699dc6395593e16a40cd6b0057dd5b42208aaaa5601277e
-
SSDEEP
12288:n4evJFLK39GlvSeWmTdmUBI+nKiTm/P9qt/kdK4HTN:n4ev3YyvSupmfyKiTM1q
Static task
static1
Behavioral task
behavioral1
Sample
07e31a5e8c561c60b4a1768f68bd0699db9e5b185f03d6170d735e2b92da1f4e.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
dubaioilandgas.xyz - Port:
587 - Username:
wealthlogs@dubaioilandgas.xyz - Password:
7213575aceACE@#$ - Email To:
wealth@dubaioilandgas.xyz
https://api.telegram.org/bot5321688653:AAEI2yqGrOA_-sRZ3xaqutrexraSgFa0AnA/sendMessage?chat_id=5048077662
Targets
-
-
Target
07e31a5e8c561c60b4a1768f68bd0699db9e5b185f03d6170d735e2b92da1f4e
-
Size
806KB
-
MD5
fd9bc712624cfc6075a4b5f58a989462
-
SHA1
afa4d6a3494c364e3f00fc6dba9f931e8ac58276
-
SHA256
07e31a5e8c561c60b4a1768f68bd0699db9e5b185f03d6170d735e2b92da1f4e
-
SHA512
f1e71d874e2843b9599eaa0c7f6b10251b8bca10a637e5cf06dff9c8c5d06ac4b6e00cad93c58ed47699dc6395593e16a40cd6b0057dd5b42208aaaa5601277e
-
SSDEEP
12288:n4evJFLK39GlvSeWmTdmUBI+nKiTm/P9qt/kdK4HTN:n4ev3YyvSupmfyKiTM1q
Score10/10-
Snake Keylogger payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-