General
-
Target
xveXYcYoRA9ESLn.exe
-
Size
643KB
-
Sample
230802-krjkdseh3x
-
MD5
6347fb31f9109c673ad871a53592aa05
-
SHA1
e27fcd68f9a792b338243354c758beea0e5699b8
-
SHA256
afcf2d75de98e641cb9555de188660470893d84e4c22577cd56f947e5a54223a
-
SHA512
50f54f1680baf1a4d354fc789427a535e6016dded9340d27595908defcf68e052331a16d508d974e913ca6e120b27c8649869f450be3f36b603fa69ddc78e1cf
-
SSDEEP
12288:15MYIRXDdvSRkM15dSe01rrG7F7Be7oyOH/ElayoBDef3TMMMDMMM:16FRXxvSRkMJArylB4oyc/ElaZefTMM7
Static task
static1
Behavioral task
behavioral1
Sample
xveXYcYoRA9ESLn.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
xveXYcYoRA9ESLn.exe
Resource
win10v2004-20230703-en
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6454328840:AAFhLVGRU2auzr2_1A08UAoSV1INpU42j7g/sendMessage?chat_id=6315669338
Targets
-
-
Target
xveXYcYoRA9ESLn.exe
-
Size
643KB
-
MD5
6347fb31f9109c673ad871a53592aa05
-
SHA1
e27fcd68f9a792b338243354c758beea0e5699b8
-
SHA256
afcf2d75de98e641cb9555de188660470893d84e4c22577cd56f947e5a54223a
-
SHA512
50f54f1680baf1a4d354fc789427a535e6016dded9340d27595908defcf68e052331a16d508d974e913ca6e120b27c8649869f450be3f36b603fa69ddc78e1cf
-
SSDEEP
12288:15MYIRXDdvSRkM15dSe01rrG7F7Be7oyOH/ElayoBDef3TMMMDMMM:16FRXxvSRkMJArylB4oyc/ElaZefTMM7
Score10/10-
Snake Keylogger payload
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-