General
-
Target
Zqpnld.exe
-
Size
13KB
-
Sample
230721-gjk7gacb83
-
MD5
3c900afab0487e5ece8a8369f470f462
-
SHA1
cc160de529d80c8a387e6729b737bc7c70234f41
-
SHA256
9cab35781360174ec179b142782b298fb5b7b3cf60dda169e5991fb6a86bd3a4
-
SHA512
37ad2d245acd1355ea8eedf64d4d6775e5d699bb7627549e8b7298db722d80ee2443dd1ad951e01d4c38a0c0b93b61b0dfb8cbf863fd3c123693bd92c4ed09b4
-
SSDEEP
192:1MiUFyvhic3V44I0wWFOurXIn88aIjOUpYkC88aHRjOUpYABZfGEp8T:2lFOhd1I07FOue88a+XpBC88a9Xp8
Static task
static1
Behavioral task
behavioral1
Sample
Zqpnld.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Zqpnld.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6362226928:AAEy_YKrGOhDs-QKpzHM8bwWaBrcjSBTM4A/sendMessage?chat_id=6373691592
Targets
-
-
Target
Zqpnld.exe
-
Size
13KB
-
MD5
3c900afab0487e5ece8a8369f470f462
-
SHA1
cc160de529d80c8a387e6729b737bc7c70234f41
-
SHA256
9cab35781360174ec179b142782b298fb5b7b3cf60dda169e5991fb6a86bd3a4
-
SHA512
37ad2d245acd1355ea8eedf64d4d6775e5d699bb7627549e8b7298db722d80ee2443dd1ad951e01d4c38a0c0b93b61b0dfb8cbf863fd3c123693bd92c4ed09b4
-
SSDEEP
192:1MiUFyvhic3V44I0wWFOurXIn88aIjOUpYkC88aHRjOUpYABZfGEp8T:2lFOhd1I07FOue88a+XpBC88a9Xp8
Score10/10-
Snake Keylogger payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-