General
-
Target
New order_letter.Pdf.z
-
Size
937KB
-
Sample
230606-qhz4nsec81
-
MD5
1c4cc85e63aef44062de90c698ad8b52
-
SHA1
f9b5d00ca4442e8447089a8fe20f790f0fefdb7b
-
SHA256
fac93de25c552a2dad517f0434b6a4f4929c3a914864b165efa173bc70e63621
-
SHA512
ab9b155665aeb74eb0633538bd4eb74f5742de26ef4ad40f41930fab7912cc4e9ff21662d71b1d8e51c5156c600efdf87f4e47aa93c99469ea681a15b684f103
-
SSDEEP
24576:G5Fo0gx3ZdNKkFpU68GDmFFmQytIAaXNWHxb20:EozxJdLpDYPQImM0
Static task
static1
Behavioral task
behavioral1
Sample
New order_letter.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
New order_letter.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6288005341:AAGRgYv2o5lUGc3tnZ9QIy4L5Vg9lraTrSs/sendMessage?chat_id=6121807451
Targets
-
-
Target
New order_letter.exe
-
Size
1.0MB
-
MD5
67e420f5e4608735ca8b9bd040ce0ee2
-
SHA1
1d2924461a44d72abf3f8c60503335a4408fb30b
-
SHA256
b6e2c83fca7727bb38feb6e83228c4157155868ec1e088ccd8d61e15477d3ad0
-
SHA512
8d15c60671923505b85ca21120b2dc7a0c07855bee85a51c4e6098d2271987d72eb395405e3b5fe520cdefa29f88b82c636364f952faffcad7ec3dda2f2438fc
-
SSDEEP
24576:BEmFxUe2I9CPa23VRvCT033NUoGIF0z7VJO:WmFxUe2rPa23TCloGOGJ
Score10/10-
Snake Keylogger payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-