General
-
Target
Siparis 02.08.023.exe
-
Size
640KB
-
Sample
230802-g4bhrsdb82
-
MD5
08a2328781ea1a31a981c4474c0d097d
-
SHA1
2eb7fbf701e8739c80ff27134a67eb6fee6bf4c0
-
SHA256
3331e4358de7df247634699487afe492edf9af859cd588304ce9f0c6cb542cc3
-
SHA512
8de6f3abee3d6e01d6b70cc214f7f60e518dbf7e45770b8e916d1d92bc020561f597bc6e50664f28b62c8607813f6f94e0cf9282f3d25b78969e35f4647aa5cc
-
SSDEEP
12288:S5MY96e21JbOD5fzTmzqLLb7p8tRLPT9pDF/U:S66v2LbOlfzqGP7YLPT9pDFU
Static task
static1
Behavioral task
behavioral1
Sample
Siparis 02.08.023.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Siparis 02.08.023.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.icdanismanlik.com - Port:
587 - Username:
[email protected] - Password:
Emre2010!
Targets
-
-
Target
Siparis 02.08.023.exe
-
Size
640KB
-
MD5
08a2328781ea1a31a981c4474c0d097d
-
SHA1
2eb7fbf701e8739c80ff27134a67eb6fee6bf4c0
-
SHA256
3331e4358de7df247634699487afe492edf9af859cd588304ce9f0c6cb542cc3
-
SHA512
8de6f3abee3d6e01d6b70cc214f7f60e518dbf7e45770b8e916d1d92bc020561f597bc6e50664f28b62c8607813f6f94e0cf9282f3d25b78969e35f4647aa5cc
-
SSDEEP
12288:S5MY96e21JbOD5fzTmzqLLb7p8tRLPT9pDF/U:S66v2LbOlfzqGP7YLPT9pDFU
Score10/10-
Snake Keylogger payload
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-