General
-
Target
7db30eacb2aafcd1c57d4cf6b314ca71.bin
-
Size
657KB
-
Sample
230928-cadzksfd3v
-
MD5
ed9861140ec0f6f1af48a74b855599ee
-
SHA1
7c75deb065b652e6cce62041f5a875e5f395fc3e
-
SHA256
08b5ff24234614d625e0a3571ac9b17a34c739ecae5484c206fde5b61d68e20f
-
SHA512
5d33e83a0ba6301eb188c43c462c8aff41dec51efabff5e0cf4927b8004fcd8cb0d8227713975a82c3c10f36c5c824afbd63d8adf988cec684cfbc1ee813249b
-
SSDEEP
12288:2AxiAda/JrG6MUJE07SxPmAvITjhPdnScplkqBDVSUiNV+2aaqF/qcqtGZQV3P:tDda/vMUS07gPaPscntoxqFCcqtGZU
Static task
static1
Behavioral task
behavioral1
Sample
dfe21dcd3c319fbb88566950ad3cd104f0e76c50200687b8906975c9cdd5aee6.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
dfe21dcd3c319fbb88566950ad3cd104f0e76c50200687b8906975c9cdd5aee6.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
Protocol: ftp- Host:
ftp.product-secured.com - Port:
21 - Username:
[email protected] - Password:
2V8SHFwjad34@@##
Extracted
snakekeylogger
Protocol: ftp- Host:
ftp://ftp.product-secured.com/ - Port:
21 - Username:
[email protected] - Password:
2V8SHFwjad34@@##
Targets
-
-
Target
dfe21dcd3c319fbb88566950ad3cd104f0e76c50200687b8906975c9cdd5aee6.exe
-
Size
822KB
-
MD5
7db30eacb2aafcd1c57d4cf6b314ca71
-
SHA1
784c19294b0348258632cdacb23927063f0f7ad8
-
SHA256
dfe21dcd3c319fbb88566950ad3cd104f0e76c50200687b8906975c9cdd5aee6
-
SHA512
985bba196e18696cbe5cb06f03416f2f6b839ebdfd32ac9d4b316cbf32fa7231c5f0e6deeb84ab5271a156c35b5c04295b670dacbe8ef1b477586b0205e5baf5
-
SSDEEP
12288:91FckahW3INm7sW2ndLQJfVDb0xPkh7g9tO01ehCt6+5wVZaNY:VcDh/m7sPdLQ9VH0xPu7g9n1z6+iuY
Score10/10-
Snake Keylogger payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-