General
-
Target
05b32219ba28ab13a072418345ff8fcf.bin
-
Size
482KB
-
Sample
231012-3vbcasfd2v
-
MD5
44c9628a38c17dc77a53a34104c2cf2b
-
SHA1
3b5a6b748b84585fc723206b1f8fe2693619f4ac
-
SHA256
91cc55f0d60280a6c5e29de69890a1e62b14fb28a40091b925bc8ba183305331
-
SHA512
131250a815fdde711144e5a8b3787784318af93e65c15bec930788fd4ea86f35f6c3a2126a38d6421a0cb6145575501b9566051869d4385519c14e7c335bee32
-
SSDEEP
12288:XFGpbY0Hb6qE+BqUcNxYyX5exccI3BhZE0mWtuEheOE:wpbY0+TtSysX6EEq
Static task
static1
Behavioral task
behavioral1
Sample
83540f97470f788a836b7e0eeb923c095b76b4d4c447e62e8d06f48ad5646686.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
83540f97470f788a836b7e0eeb923c095b76b4d4c447e62e8d06f48ad5646686.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.gkas.com.tr - Port:
587 - Username:
[email protected] - Password:
Gkasteknik@2022
Targets
-
-
Target
83540f97470f788a836b7e0eeb923c095b76b4d4c447e62e8d06f48ad5646686.exe
-
Size
516KB
-
MD5
05b32219ba28ab13a072418345ff8fcf
-
SHA1
8fba98bc56b189a2fbd081fbf8813deffcf564ca
-
SHA256
83540f97470f788a836b7e0eeb923c095b76b4d4c447e62e8d06f48ad5646686
-
SHA512
d305fddbde5e39742a554e01abdb94ea3a66673aa2f9323cc2a31a05e5ec4cd6ecc96586c7bf9b1a2e8c4841f41c92e3e30c172b5e5e79d4a76dfae85dca079a
-
SSDEEP
12288:BG2iNKpaN08GWwzoLlObPcVdmHb5GBXnaxNYN2MW6uwgDGlkU:BG10pa9zesObPcVA7Q1QVU
Score10/10-
Snake Keylogger payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-