General
-
Target
PO 1100112186.exe
-
Size
469KB
-
Sample
231025-tx31nacf8v
-
MD5
6b676e72f5850ce4aa0f3878ac4cd1c3
-
SHA1
674094e918afa0254f6dacce42d6a0c8dac57104
-
SHA256
7cdaec4816187a281084f9274bed4893b2d850bad9ceb7d0bdd4571fbbaa5cb7
-
SHA512
ef19530fb734e5f952f5f95f68cdf860a80d09c540a691868d007110b330bba31e5a27ac65c3b34c0764e27adb153fa6f470588e2c5323b559c3153f8ac53514
-
SSDEEP
6144:Fb+wCKrBMNitx22SYwhe4nhLkgypkkeCCcFsPe35bgaG/vJZsL:J+wfr6wdSYge2I8wCcL35bgaGps
Static task
static1
Behavioral task
behavioral1
Sample
PO 1100112186.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
PO 1100112186.exe
Resource
win10v2004-20231020-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.alualuminium.com.my - Port:
587 - Username:
[email protected] - Password:
U8G4S13#8Zk$ - Email To:
[email protected]
Targets
-
-
Target
PO 1100112186.exe
-
Size
469KB
-
MD5
6b676e72f5850ce4aa0f3878ac4cd1c3
-
SHA1
674094e918afa0254f6dacce42d6a0c8dac57104
-
SHA256
7cdaec4816187a281084f9274bed4893b2d850bad9ceb7d0bdd4571fbbaa5cb7
-
SHA512
ef19530fb734e5f952f5f95f68cdf860a80d09c540a691868d007110b330bba31e5a27ac65c3b34c0764e27adb153fa6f470588e2c5323b559c3153f8ac53514
-
SSDEEP
6144:Fb+wCKrBMNitx22SYwhe4nhLkgypkkeCCcFsPe35bgaG/vJZsL:J+wfr6wdSYge2I8wCcL35bgaGps
Score10/10-
Snake Keylogger payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-