General
-
Target
HSBC Payment Advice.exe
-
Size
930KB
-
Sample
221125-hn73gahd27
-
MD5
09292630656c8ce03a104cd047232c1e
-
SHA1
1e1e40ee89b10d6edb9b97b79c9b187f7f38b67c
-
SHA256
b7dbc97b8a087264217178dbff138d86940c1da6ae255a47cf98f0fa86d767e0
-
SHA512
2b139085051085beacfb4c0553d5f450f4b06fcf79fcf3df537c59d5bc3401c2c01939d31b10012c59312e59a2ee46bfbb97cf1abc2a4ce541e911a64fcc3742
-
SSDEEP
24576:IDhusk449zFtZ++tr6cUm/osz9YJu2CYV:IDkskXz//dz9Y
Static task
static1
Behavioral task
behavioral1
Sample
HSBC Payment Advice.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
HSBC Payment Advice.exe
Resource
win10v2004-20220901-en
Malware Config
Targets
-
-
Target
HSBC Payment Advice.exe
-
Size
930KB
-
MD5
09292630656c8ce03a104cd047232c1e
-
SHA1
1e1e40ee89b10d6edb9b97b79c9b187f7f38b67c
-
SHA256
b7dbc97b8a087264217178dbff138d86940c1da6ae255a47cf98f0fa86d767e0
-
SHA512
2b139085051085beacfb4c0553d5f450f4b06fcf79fcf3df537c59d5bc3401c2c01939d31b10012c59312e59a2ee46bfbb97cf1abc2a4ce541e911a64fcc3742
-
SSDEEP
24576:IDhusk449zFtZ++tr6cUm/osz9YJu2CYV:IDkskXz//dz9Y
-
Snake Keylogger payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-