General
-
Target
5yjBTV1RX69ix2q.exe
-
Size
573KB
-
Sample
230929-kqf3wagh3s
-
MD5
6b4f6cc2f9b20734530acf3124a14cac
-
SHA1
a07f1d4fe758c87819ff62671e015dbb38b8a7ac
-
SHA256
d0018553788684559db6376fe759c7eb91b56532f24fcdee4468dae430511231
-
SHA512
9000588d205a4e8ce68f3f6568ec9b82be16c85cd34695c9045f6e968f6529316995efa8cd11c889fcca89b287eb3e8a7a9d079662eba71aa3e102c79f194eaf
-
SSDEEP
12288:QMiyiRJU/WceD6+kpqkIaHkuhirf6Kgtom55Nk5PMVFS:jZFe/ZkcH+kp2nHHm0
Static task
static1
Behavioral task
behavioral1
Sample
5yjBTV1RX69ix2q.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
5yjBTV1RX69ix2q.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
smtp.1tcl.com - Port:
25 - Username:
[email protected] - Password:
RRa*ysS8
Targets
-
-
Target
5yjBTV1RX69ix2q.exe
-
Size
573KB
-
MD5
6b4f6cc2f9b20734530acf3124a14cac
-
SHA1
a07f1d4fe758c87819ff62671e015dbb38b8a7ac
-
SHA256
d0018553788684559db6376fe759c7eb91b56532f24fcdee4468dae430511231
-
SHA512
9000588d205a4e8ce68f3f6568ec9b82be16c85cd34695c9045f6e968f6529316995efa8cd11c889fcca89b287eb3e8a7a9d079662eba71aa3e102c79f194eaf
-
SSDEEP
12288:QMiyiRJU/WceD6+kpqkIaHkuhirf6Kgtom55Nk5PMVFS:jZFe/ZkcH+kp2nHHm0
Score10/10-
Snake Keylogger payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-