General
-
Target
mkpub_AEAT - Aviso de Notificación (2)_02102023.rar
-
Size
493KB
-
Sample
231003-qmtgpaah7t
-
MD5
9c5f462bc2d318943ef1ea564ae0b6fa
-
SHA1
b1b71c9df7ec2a3a15afe1e4c3055d06d178d268
-
SHA256
3bea193608c6cb0c9667665e349a7dfe61fa0c5be7e0d95ce321384e8cb599b3
-
SHA512
4aec88f8234476d4928212d3c35d5a5eccfdb65aa99f16f4ba04a9806ed2c1de26a238b910dda9c1a742172c553ab715b280e44d190d5f3023ab38c0e757d02c
-
SSDEEP
12288:m++g0SgdptYatxhrV24jJ93V9WBBeKD5XW9s2FbpHdtovqzu:m++g2saZrPJncBldXgsWBqqC
Static task
static1
Behavioral task
behavioral1
Sample
AEAT - Aviso de Notificación (2).exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
AEAT - Aviso de Notificación (2).exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.setimetrasa.com - Port:
587 - Username:
[email protected] - Password:
Seti2020 - Email To:
[email protected]
Targets
-
-
Target
AEAT - Aviso de Notificación (2).exe
-
Size
548KB
-
MD5
7bbadb55076fd343bed53fb839524c92
-
SHA1
4bb956cda4ca089cbfdc80f913fb7a2cc5bcc45d
-
SHA256
74c687d2cbb8e93481530eba3ec627b5d9902901797e67fce58a949b8b50491c
-
SHA512
d806d10c1df5e988d2a832bee1dc8a2cc22fb196e0abf471e2ceac8ca6dbe797e5b9e197867bcf579a47ed0fbdc6e8781e7bb0250ca1710ffbb95e3c8e1d4130
-
SSDEEP
12288:EneUsNumB0lMBIlD1WtyDROlTJNR0trAeuq28cZs9I11vg/5:sjyOD1Wt2ON5KLcZsyYh
Score10/10-
Snake Keylogger payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-