General
-
Target
A.exe
-
Size
443KB
-
Sample
230604-s2fv9adc2t
-
MD5
706c4e397de8260d889cf83ba6707e7c
-
SHA1
dd4510b6e29157b56b894e06cc8f8687f4af7143
-
SHA256
1df360694e4b54909b416b5ef5095e54827c8e53d77885032df144272508f013
-
SHA512
d3c55835ff9bc6b00de4e82fc4318baf66a63733c7c88d8a5cd87430038fe7dd35a547dd1978a372dee9b59b8ba9a10e2ed5f35a146342ae4eba8c46da8893e3
-
SSDEEP
6144:Ih7kAkJ0xZuuRlxnUDcWZXA3Zz9mTFLHjhzypfbVb4vG8nYH5d7cwSthf64lv:IJLkJARWIyXa5ULHjIZKYH5VvStRTJ
Static task
static1
Behavioral task
behavioral1
Sample
A.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
A.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6184780923:AAHbCGrBU_2zg9A-73yTyKKCMGf1tkzUFbM/sendMessage?chat_id=759814203
Targets
-
-
Target
A.exe
-
Size
443KB
-
MD5
706c4e397de8260d889cf83ba6707e7c
-
SHA1
dd4510b6e29157b56b894e06cc8f8687f4af7143
-
SHA256
1df360694e4b54909b416b5ef5095e54827c8e53d77885032df144272508f013
-
SHA512
d3c55835ff9bc6b00de4e82fc4318baf66a63733c7c88d8a5cd87430038fe7dd35a547dd1978a372dee9b59b8ba9a10e2ed5f35a146342ae4eba8c46da8893e3
-
SSDEEP
6144:Ih7kAkJ0xZuuRlxnUDcWZXA3Zz9mTFLHjhzypfbVb4vG8nYH5d7cwSthf64lv:IJLkJARWIyXa5ULHjIZKYH5VvStRTJ
Score10/10-
Snake Keylogger payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-