General
-
Target
6b676e72f5850ce4aa0f3878ac4cd1c3.bin
-
Size
312KB
-
Sample
231027-cadc2sbb2z
-
MD5
209dd083eb1825f48a0c623df6f8b425
-
SHA1
f4116483a4953720c70261e166ab508d85bbda31
-
SHA256
db6b10d70af9876e38f9241952272b49a35ce1325a5e5eccb03f8d55be0bccce
-
SHA512
fdaeeeff7aa386e3801197326383e6e3e950a67a08c31594ff96183b8307db4ba0d19e637f0257c6ca40aac935e873e2467deed8230a22826bb6e00423d1c370
-
SSDEEP
6144:A8bcGHSBjD+G/HtydHDvhYBlUY4nVJcOb2oCwtGXEV4t28rRuSAc4wfRnj:FbcG2jD+GVydroUYIs+taI4t2jo4wj
Static task
static1
Behavioral task
behavioral1
Sample
7cdaec4816187a281084f9274bed4893b2d850bad9ceb7d0bdd4571fbbaa5cb7.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
7cdaec4816187a281084f9274bed4893b2d850bad9ceb7d0bdd4571fbbaa5cb7.exe
Resource
win10v2004-20231023-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.alualuminium.com.my - Port:
587 - Username:
[email protected] - Password:
U8G4S13#8Zk$ - Email To:
[email protected]
Targets
-
-
Target
7cdaec4816187a281084f9274bed4893b2d850bad9ceb7d0bdd4571fbbaa5cb7.exe
-
Size
469KB
-
MD5
6b676e72f5850ce4aa0f3878ac4cd1c3
-
SHA1
674094e918afa0254f6dacce42d6a0c8dac57104
-
SHA256
7cdaec4816187a281084f9274bed4893b2d850bad9ceb7d0bdd4571fbbaa5cb7
-
SHA512
ef19530fb734e5f952f5f95f68cdf860a80d09c540a691868d007110b330bba31e5a27ac65c3b34c0764e27adb153fa6f470588e2c5323b559c3153f8ac53514
-
SSDEEP
6144:Fb+wCKrBMNitx22SYwhe4nhLkgypkkeCCcFsPe35bgaG/vJZsL:J+wfr6wdSYge2I8wCcL35bgaGps
Score10/10-
Snake Keylogger payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-