General
-
Target
AEAT - Aviso de Notificación (2).exe
-
Size
548KB
-
Sample
231003-gwn4wsge8x
-
MD5
7bbadb55076fd343bed53fb839524c92
-
SHA1
4bb956cda4ca089cbfdc80f913fb7a2cc5bcc45d
-
SHA256
74c687d2cbb8e93481530eba3ec627b5d9902901797e67fce58a949b8b50491c
-
SHA512
d806d10c1df5e988d2a832bee1dc8a2cc22fb196e0abf471e2ceac8ca6dbe797e5b9e197867bcf579a47ed0fbdc6e8781e7bb0250ca1710ffbb95e3c8e1d4130
-
SSDEEP
12288:EneUsNumB0lMBIlD1WtyDROlTJNR0trAeuq28cZs9I11vg/5:sjyOD1Wt2ON5KLcZsyYh
Static task
static1
Behavioral task
behavioral1
Sample
AEAT - Aviso de Notificación (2).exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
AEAT - Aviso de Notificación (2).exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.setimetrasa.com - Port:
587 - Username:
[email protected] - Password:
Seti2020 - Email To:
[email protected]
Targets
-
-
Target
AEAT - Aviso de Notificación (2).exe
-
Size
548KB
-
MD5
7bbadb55076fd343bed53fb839524c92
-
SHA1
4bb956cda4ca089cbfdc80f913fb7a2cc5bcc45d
-
SHA256
74c687d2cbb8e93481530eba3ec627b5d9902901797e67fce58a949b8b50491c
-
SHA512
d806d10c1df5e988d2a832bee1dc8a2cc22fb196e0abf471e2ceac8ca6dbe797e5b9e197867bcf579a47ed0fbdc6e8781e7bb0250ca1710ffbb95e3c8e1d4130
-
SSDEEP
12288:EneUsNumB0lMBIlD1WtyDROlTJNR0trAeuq28cZs9I11vg/5:sjyOD1Wt2ON5KLcZsyYh
Score10/10-
Snake Keylogger payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-