General
-
Target
JSCA0085.xlsx.exe
-
Size
911KB
-
Sample
230610-l5d3hafd3v
-
MD5
0302ea3ea95d18d9005ac91a566760c4
-
SHA1
b9ceff54b9e8ac231ed2ce3405a3a22122fe82e6
-
SHA256
f201c50d1f743c1b9b58595e927e8d6394ab37a6825bc7f8dc15f63f031c98c5
-
SHA512
2759ac9383877df0d4dfa16e12fa7699c30f238011a6f96b606fa7c46a98772b801772bc9e9d219b0132e3acc57be0129462c96476e8ff16290f6e7abcf01fd0
-
SSDEEP
12288:qoLGv1oKAdVMnJn+fuNKac6ZP3Vp5ji9i1BI:vcoKAs4fuNrpZP3b8Z
Static task
static1
Behavioral task
behavioral1
Sample
JSCA0085.xlsx.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
JSCA0085.xlsx.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot5818680343:AAGVJsfIHcopySiifMCdAaFCv-ICp2_Yo_M/sendMessage?chat_id=5765702254
Targets
-
-
Target
JSCA0085.xlsx.exe
-
Size
911KB
-
MD5
0302ea3ea95d18d9005ac91a566760c4
-
SHA1
b9ceff54b9e8ac231ed2ce3405a3a22122fe82e6
-
SHA256
f201c50d1f743c1b9b58595e927e8d6394ab37a6825bc7f8dc15f63f031c98c5
-
SHA512
2759ac9383877df0d4dfa16e12fa7699c30f238011a6f96b606fa7c46a98772b801772bc9e9d219b0132e3acc57be0129462c96476e8ff16290f6e7abcf01fd0
-
SSDEEP
12288:qoLGv1oKAdVMnJn+fuNKac6ZP3Vp5ji9i1BI:vcoKAs4fuNrpZP3b8Z
Score10/10-
Snake Keylogger payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-