General
-
Target
b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077
-
Size
637KB
-
Sample
221125-j56reagf6w
-
MD5
aa5e35e6ffba2eae676a098b78bfb93d
-
SHA1
a661569ff4316565c7b20e957b42f017974010f9
-
SHA256
b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077
-
SHA512
3c7669acc40c470fda3bbe46d4a284d4298de7cf94c5579ccf0fbbaacee019d4cb207c0437df0a1823cfdde37f0f236baa7d25d322de342a17f007bdbfd325a0
-
SSDEEP
12288:jCgh/PsZ1DX/VDJyJzIFaG7f/6TYs0xdWO9gAlPy5xuf9WY9:jCgh/PhJzOt/yYBfPy5xuf9WY9
Static task
static1
Behavioral task
behavioral1
Sample
b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077.exe
Resource
win10-20220812-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
doDHyw%0 - Email To:
[email protected]
Targets
-
-
Target
b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077
-
Size
637KB
-
MD5
aa5e35e6ffba2eae676a098b78bfb93d
-
SHA1
a661569ff4316565c7b20e957b42f017974010f9
-
SHA256
b2dbb7bcb28f662354fe87b0d2fc0915dfdc12d16987ab6e7bf64beaa24bc077
-
SHA512
3c7669acc40c470fda3bbe46d4a284d4298de7cf94c5579ccf0fbbaacee019d4cb207c0437df0a1823cfdde37f0f236baa7d25d322de342a17f007bdbfd325a0
-
SSDEEP
12288:jCgh/PsZ1DX/VDJyJzIFaG7f/6TYs0xdWO9gAlPy5xuf9WY9:jCgh/PhJzOt/yYBfPy5xuf9WY9
Score10/10-
Snake Keylogger payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-