General
-
Target
c61fb6e79063dfdbb6a8f7c8a4517c8ad21c93c221e695b9eaabdd35f238b012
-
Size
585KB
-
Sample
231205-j7pkxaaa5v
-
MD5
5e5594ae2093d5117e7aa10a6f04e1db
-
SHA1
3bba36a8907654d58976c15cdc8444a62b01d538
-
SHA256
c61fb6e79063dfdbb6a8f7c8a4517c8ad21c93c221e695b9eaabdd35f238b012
-
SHA512
7dfeb0c4aa84b3b09753af85fb86d72c464c79fcce1f25ea7882f70888d2813049010aeb8f48631d2a428845fa125b61716278998e1d7c68f8837ed4afe17ef6
-
SSDEEP
12288:+oqNFJta3gaYbQuohmuJo/6PNvQs2IJC71mKhqzhX/+s1X2X44c9pfo+PX9fjO7:+tY3gbTruJU6VvSIJC71mKkJ+C2X4f9w
Static task
static1
Behavioral task
behavioral1
Sample
IV2312-001 ORDER.exe
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
IV2312-001 ORDER.exe
Resource
win10v2004-20231130-en
Malware Config
Targets
-
-
Target
IV2312-001 ORDER.exe
-
Size
792KB
-
MD5
bc79982caee7c5098059a43222a7f0cf
-
SHA1
2657aa5f642e8c261f457c9e1684c5b37b7dc6a1
-
SHA256
8c9a4a7a2805ac96e157dc3681cc0a382f27878a3835ff4db8070b72d75062a5
-
SHA512
396e633a36e6693aecd0ea99d194acf6854dc7a96a9661ca6c201b88d464b6a4da652c34822e0f7cb43e6255d776841aa7386cdfc154fdc41bf08e4995eaafec
-
SSDEEP
12288:72BKE6jD/62iNG5nF88+ziZqkuesCpt/BEGftxcmdA5CAsNb1A3cM:7EKtD/61IqeGVCphBpl7Am1Ax
Score10/10-
Snake Keylogger payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-