General
-
Target
FACTRA09876545689000.exe
-
Size
473KB
-
Sample
231013-zelasafa7z
-
MD5
1853308b40b353d110ecbd0c0e09b24a
-
SHA1
3b6f5aceb5d114178304588493eed2281718f358
-
SHA256
19f5a1432457383a9f992ee9b9ebf5e719b3709dc630146a083843a582d6996f
-
SHA512
f053ed9f68b5fd55f57e4cccf40271109c89e282fa67dc4a195a0c89b9d79198431ed785fbbb35450775feaa37235a288e3b28dfaa39f64611cb0fd8523c7b89
-
SSDEEP
12288:gkSMfMGuMFex9HNHfMGuMFex6R1SNjRZxF:jSMEGMSGMlNjR
Static task
static1
Behavioral task
behavioral1
Sample
FACTRA09876545689000.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
FACTRA09876545689000.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.sienkakupeste.com - Port:
587 - Username:
[email protected] - Password:
010203sienka++ - Email To:
[email protected]
Targets
-
-
Target
FACTRA09876545689000.exe
-
Size
473KB
-
MD5
1853308b40b353d110ecbd0c0e09b24a
-
SHA1
3b6f5aceb5d114178304588493eed2281718f358
-
SHA256
19f5a1432457383a9f992ee9b9ebf5e719b3709dc630146a083843a582d6996f
-
SHA512
f053ed9f68b5fd55f57e4cccf40271109c89e282fa67dc4a195a0c89b9d79198431ed785fbbb35450775feaa37235a288e3b28dfaa39f64611cb0fd8523c7b89
-
SSDEEP
12288:gkSMfMGuMFex9HNHfMGuMFex6R1SNjRZxF:jSMEGMSGMlNjR
Score10/10-
Snake Keylogger payload
-
Drops startup file
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-