General
-
Target
01973f09014fee62754ea67861264da5.bin
-
Size
638KB
-
Sample
230928-bcqwgsfb6w
-
MD5
b218c54136ad02c9fe719d67fb97a26b
-
SHA1
e6d4ee03faf4707526158273e8ec5779fabf27f2
-
SHA256
3f4787a9691512f34f66042da6e34f2967dc368f3d17b95a202c397218ed1063
-
SHA512
ea0acbc5eac9588e391f9b56cb7c9e5dc211b93b64b4391199ce03d68586ea4ac269119ad46bf9bcf5c4866906ec46c1423f4f73667cf3ef9ff5dc9fdb30ab05
-
SSDEEP
12288:TZG/2ScqUuIhnyESuxJs4Qw4assqSJHuzUXnz/TpLY9MOqnY85oZX+F:TZG/2LdryESeKPwCsqMHX3z/tLDOqnYO
Static task
static1
Behavioral task
behavioral1
Sample
4110933fe032350468c29329959cb10fc54704a2ec7af1e71155202a337aee6d.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
4110933fe032350468c29329959cb10fc54704a2ec7af1e71155202a337aee6d.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
Protocol: ftp- Host:
ftp.royalcheckout.store - Port:
21 - Username:
[email protected] - Password:
esubwDViXlQ2@@##
Extracted
snakekeylogger
Protocol: ftp- Host:
ftp://ftp.royalcheckout.store/ - Port:
21 - Username:
[email protected] - Password:
esubwDViXlQ2@@##
Targets
-
-
Target
4110933fe032350468c29329959cb10fc54704a2ec7af1e71155202a337aee6d.exe
-
Size
807KB
-
MD5
01973f09014fee62754ea67861264da5
-
SHA1
d8b34971917d38fe2b097604325e277a3c23ebb3
-
SHA256
4110933fe032350468c29329959cb10fc54704a2ec7af1e71155202a337aee6d
-
SHA512
90f444be2ec94092030359a06b9a790b580a1cd3c13f98add7b0012144f65c01b091129165db4f2374a52f74c9a7c2e7e332661fe76481f2de392b4a77079ee9
-
SSDEEP
12288:d1F0ILW7uyIdVhDGoTkjg7vSMePpL71uFYD0kIy0MWaP7anc1Z:10IeIdDxe1PpLpsumD5aDGc1
Score10/10-
Snake Keylogger payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-