General
-
Target
1853308b40b353d110ecbd0c0e09b24abin_JC.zip
-
Size
368KB
-
Sample
231012-2aqqtade5s
-
MD5
714b0c622a6bf78e2de10f98282ccbe5
-
SHA1
f4979773f317c171c0ab82f78828864834f41f4b
-
SHA256
c12da4e9e5ac0b236f2671657865198ac8f7916ac1cbe96cae99b93e2a347ad1
-
SHA512
66f9b318d178588bd9579b1ce1f04d9ccbcf308ce2a49e6f1a09c57f848c292b83dfbf44275de2174e8cff1d58613f7a55d3528d23f49d650c9528d03aa254f9
-
SSDEEP
6144:1a/uw+t88RPGwLxX+7JxyS7rlRri7dYIpRAHkimBFo9YrG6b:IfV8RPGwNIJxj3ri7TpRam0oGu
Static task
static1
Behavioral task
behavioral1
Sample
19f5a1432457383a9f992ee9b9ebf5e719b3709dc630146a083843a582d6996f.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
19f5a1432457383a9f992ee9b9ebf5e719b3709dc630146a083843a582d6996f.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.sienkakupeste.com - Port:
587 - Username:
[email protected] - Password:
010203sienka++ - Email To:
[email protected]
Targets
-
-
Target
19f5a1432457383a9f992ee9b9ebf5e719b3709dc630146a083843a582d6996f.exe
-
Size
473KB
-
MD5
1853308b40b353d110ecbd0c0e09b24a
-
SHA1
3b6f5aceb5d114178304588493eed2281718f358
-
SHA256
19f5a1432457383a9f992ee9b9ebf5e719b3709dc630146a083843a582d6996f
-
SHA512
f053ed9f68b5fd55f57e4cccf40271109c89e282fa67dc4a195a0c89b9d79198431ed785fbbb35450775feaa37235a288e3b28dfaa39f64611cb0fd8523c7b89
-
SSDEEP
12288:gkSMfMGuMFex9HNHfMGuMFex6R1SNjRZxF:jSMEGMSGMlNjR
Score10/10-
Snake Keylogger payload
-
Drops startup file
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-