General
-
Target
995d7782b47ae9d044a0a1edf76a011241ab941c09af6e8a90eeab23f82225e2.exe.zip
-
Size
322KB
-
Sample
231002-nv5tksbd93
-
MD5
4bbd59021796db8b32269c779c64ee02
-
SHA1
e55e03bd911006b7181075c769f6a9657b381eb5
-
SHA256
73c37a80aacacd4735a50f6dfb7f2be1183e1020da3e8ea5ad3f3dcc885de761
-
SHA512
fd6ca225272710679dc0384b5cf30c5b709b293b0c56f0bf77f96668425623941030ec78bfec8e487f18f4c8b4aae83b57119260ede2a35b4916c88e4a4f56af
-
SSDEEP
6144:1QgQPPdqpC5jOgWprBjZqWA52IUVjUMZp3fzzoLwp0tQGlcOsAH0n5:TGdqpGzWpljZqW22IUVLpLzokuBcOjs5
Static task
static1
Behavioral task
behavioral1
Sample
995d7782b47ae9d044a0a1edf76a011241ab941c09af6e8a90eeab23f82225e2.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
995d7782b47ae9d044a0a1edf76a011241ab941c09af6e8a90eeab23f82225e2.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
snakekeylogger
Protocol: ftp- Host:
ftp://ftp.product-secured.com/ - Port:
21 - Username:
[email protected] - Password:
575K5(MaZro2575K5(MaZro2
Extracted
Protocol: ftp- Host:
ftp.product-secured.com - Port:
21 - Username:
[email protected] - Password:
575K5(MaZro2575K5(MaZro2
Targets
-
-
Target
995d7782b47ae9d044a0a1edf76a011241ab941c09af6e8a90eeab23f82225e2.exe
-
Size
515KB
-
MD5
1bd78136fa8b9e9e63fde92829a9743d
-
SHA1
c9a07ff3362a68baa159521c6946026e4cc0f17b
-
SHA256
995d7782b47ae9d044a0a1edf76a011241ab941c09af6e8a90eeab23f82225e2
-
SHA512
47b43fa93e7da900c8f520a66bbf28af3fc5e5e7185b9735aa27508d9a7498334c649a3380a918969bc9db0b975b7dfd6bb4936260424b906ea291a62795af15
-
SSDEEP
6144:tZQ1L8X3KA0CJIJr/yl8ntd9wxJA4jLXIwejp9R37+RRmpr2MUX9xRjVJiJxeyBc:fQ1BCJIBd6xXIbjp9RSzsr2FgO
Score10/10-
Snake Keylogger payload
-
Executes dropped EXE
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-