General
-
Target
MV ALPHA CONFIDENCE Q88.exe
-
Size
431KB
-
Sample
231006-qxca6aca9s
-
MD5
6e2c37cc44994176f0be4341b0e00a81
-
SHA1
08a4eeee17aa22b02f30e894e9143db2d7807e01
-
SHA256
990fb39dbcb7f531cf61e9c97392716437a51e84a5af37506f35b23560f2603e
-
SHA512
b5d053fa55aafaa3ab6f575aa0ab221ce8b0907c557c18d59fdef693a1c36d1617caa55151ede424461e94a0ceb79b1e4f252c5230c4a17b302449bb17a71805
-
SSDEEP
6144:l0iWylma897wBVaT/yKBzff4dT6k/7n0kLlRUz0DbkSwY7rA6lUD+QWIXJeqOzDU:l0dyYV9HtUd/LACciIcqOzDRRLrJjxu
Static task
static1
Behavioral task
behavioral1
Sample
MV ALPHA CONFIDENCE Q88.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
MV ALPHA CONFIDENCE Q88.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.biglifshipping.com - Port:
587 - Username:
[email protected] - Password:
6[p8H(X_rbxr8&*k
Targets
-
-
Target
MV ALPHA CONFIDENCE Q88.exe
-
Size
431KB
-
MD5
6e2c37cc44994176f0be4341b0e00a81
-
SHA1
08a4eeee17aa22b02f30e894e9143db2d7807e01
-
SHA256
990fb39dbcb7f531cf61e9c97392716437a51e84a5af37506f35b23560f2603e
-
SHA512
b5d053fa55aafaa3ab6f575aa0ab221ce8b0907c557c18d59fdef693a1c36d1617caa55151ede424461e94a0ceb79b1e4f252c5230c4a17b302449bb17a71805
-
SSDEEP
6144:l0iWylma897wBVaT/yKBzff4dT6k/7n0kLlRUz0DbkSwY7rA6lUD+QWIXJeqOzDU:l0dyYV9HtUd/LACciIcqOzDRRLrJjxu
-
Snake Keylogger payload
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-