General
-
Target
b2f09782cc6fdc575c78fb3b0ad252cc523a8df88fcbcf0e2829d4d750406128
-
Size
1.4MB
-
Sample
221125-ltdbtscd61
-
MD5
e4592aeb6b33a38de3a80d3cfe12f7a3
-
SHA1
ee685ae882f6e0fbd9ebaa1b6488e546ec24da97
-
SHA256
b2f09782cc6fdc575c78fb3b0ad252cc523a8df88fcbcf0e2829d4d750406128
-
SHA512
05486287224d9dbf09c241cdb402ca3d84fc90d6515012f1ed9d86ae136d4248689f50e03bf56402b55a4e87871dbd16261992b6340e0bee066fb20e81a9b23b
-
SSDEEP
12288:H30mhGT/f7DSvWN1JuigLYVlaf+dhKeVnVBAzzpDzAK13LhHWUJ+eBlsi7ZZHEEs:kZzHSvi7AYaf+dk+gziK13lV6iLgb
Static task
static1
Behavioral task
behavioral1
Sample
b2f09782cc6fdc575c78fb3b0ad252cc523a8df88fcbcf0e2829d4d750406128.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b2f09782cc6fdc575c78fb3b0ad252cc523a8df88fcbcf0e2829d4d750406128.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot1634002210:AAGipukUEr-bNBgl2R1_hwFgfb9ez_v6wzE/sendMessage?chat_id=1401219117
Targets
-
-
Target
b2f09782cc6fdc575c78fb3b0ad252cc523a8df88fcbcf0e2829d4d750406128
-
Size
1.4MB
-
MD5
e4592aeb6b33a38de3a80d3cfe12f7a3
-
SHA1
ee685ae882f6e0fbd9ebaa1b6488e546ec24da97
-
SHA256
b2f09782cc6fdc575c78fb3b0ad252cc523a8df88fcbcf0e2829d4d750406128
-
SHA512
05486287224d9dbf09c241cdb402ca3d84fc90d6515012f1ed9d86ae136d4248689f50e03bf56402b55a4e87871dbd16261992b6340e0bee066fb20e81a9b23b
-
SSDEEP
12288:H30mhGT/f7DSvWN1JuigLYVlaf+dhKeVnVBAzzpDzAK13LhHWUJ+eBlsi7ZZHEEs:kZzHSvi7AYaf+dk+gziK13lV6iLgb
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-