General
-
Target
New product.scr.exe
-
Size
437KB
-
Sample
231023-mpdx8sfh3s
-
MD5
3e872d74cb692deb202d25859986357d
-
SHA1
9ba324ec9ff4f454409f653da5d4d7b694255d6b
-
SHA256
701d2231e9b9297450abddc537bfdb90fbb45f679b6da2e1e45b615280bd95c6
-
SHA512
90b800106b029cd671216a0566a573975a6ed3bcfd45c255f47b4e8f9766674f01e3548b5f0abce53258ec89885f8bcd04bc9c85a97596152cadcc2b361e86dd
-
SSDEEP
12288:AD7gUiVaOazGypq9Q/NGbEPAj6JYrOiqot2:daOazTNYE4j6c
Static task
static1
Behavioral task
behavioral1
Sample
New product.scr.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
New product.scr.exe
Resource
win10v2004-20231020-en
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6243209595:AAGECSmdSqJiVZcdFoBvotoaKcKT9Lz5Gvw/sendMessage?chat_id=1070926352
Targets
-
-
Target
New product.scr.exe
-
Size
437KB
-
MD5
3e872d74cb692deb202d25859986357d
-
SHA1
9ba324ec9ff4f454409f653da5d4d7b694255d6b
-
SHA256
701d2231e9b9297450abddc537bfdb90fbb45f679b6da2e1e45b615280bd95c6
-
SHA512
90b800106b029cd671216a0566a573975a6ed3bcfd45c255f47b4e8f9766674f01e3548b5f0abce53258ec89885f8bcd04bc9c85a97596152cadcc2b361e86dd
-
SSDEEP
12288:AD7gUiVaOazGypq9Q/NGbEPAj6JYrOiqot2:daOazTNYE4j6c
Score10/10-
Snake Keylogger payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-