General
-
Target
c2a09d27fb379adedacaffc2b869cb1c.exe
-
Size
657KB
-
Sample
231106-k8fvtsbg57
-
MD5
c2a09d27fb379adedacaffc2b869cb1c
-
SHA1
a30d40d85d0672d2396bb7e4f3dbfecfee861dc5
-
SHA256
87876acd533b5e473c1f27bf24ad26a9b6d0e6859186e00ac3efa334711b8f4a
-
SHA512
8085869876e6a3aa404131a4d763650b295f450bb42ef49db643409e2cfa4c69c5786130bb41b8d588889446e5844acc9501e1dfd669c05bfbf3cd1afd6fa855
-
SSDEEP
12288:mvDb0oGmX9dlSuSGy1G9ejnA2tfWpQ2pigPIQFIfcSXb0BloaBu:mv/NGmXflDSvGerHfWpQ0nJIfcu0+
Static task
static1
Behavioral task
behavioral1
Sample
c2a09d27fb379adedacaffc2b869cb1c.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
c2a09d27fb379adedacaffc2b869cb1c.exe
Resource
win10v2004-20231025-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.gkas.com.tr - Port:
587 - Username:
[email protected] - Password:
Gkasteknik@2022
Targets
-
-
Target
c2a09d27fb379adedacaffc2b869cb1c.exe
-
Size
657KB
-
MD5
c2a09d27fb379adedacaffc2b869cb1c
-
SHA1
a30d40d85d0672d2396bb7e4f3dbfecfee861dc5
-
SHA256
87876acd533b5e473c1f27bf24ad26a9b6d0e6859186e00ac3efa334711b8f4a
-
SHA512
8085869876e6a3aa404131a4d763650b295f450bb42ef49db643409e2cfa4c69c5786130bb41b8d588889446e5844acc9501e1dfd669c05bfbf3cd1afd6fa855
-
SSDEEP
12288:mvDb0oGmX9dlSuSGy1G9ejnA2tfWpQ2pigPIQFIfcSXb0BloaBu:mv/NGmXflDSvGerHfWpQ0nJIfcu0+
Score10/10-
Snake Keylogger payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-