General
-
Target
Swift_0203usd.exe
-
Size
531KB
-
Sample
231215-wyrp5agegm
-
MD5
aeeb797a4fb486c129cfa93d0e31e34c
-
SHA1
07dc4fcb6e0b8a69eb82b2b7f5e6e4d11f0f1cd4
-
SHA256
ea93863c147402b54407c3a1eff90043b55e76a08aa3ff4a8823469dd4d9def5
-
SHA512
76b90a53e6394d40c8a37a50ed5cfa93507797ee7395e5fe7d25a92c42f09564c039b3c285332282939f7aa208c421591fd18de4357786b71303d2be058a0c29
-
SSDEEP
12288:12iNb0oLtaQjlfRGqkDdu/pYVszai9YJgZ1gy:116gg0fR0ARoi9YJgZb
Static task
static1
Behavioral task
behavioral1
Sample
Swift_0203usd.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Swift_0203usd.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot6064725165:AAHXOwTVVm0GMC2M_NZjTT0hEHEGMgtU55I/sendMessage?chat_id=5361285164
Targets
-
-
Target
Swift_0203usd.exe
-
Size
531KB
-
MD5
aeeb797a4fb486c129cfa93d0e31e34c
-
SHA1
07dc4fcb6e0b8a69eb82b2b7f5e6e4d11f0f1cd4
-
SHA256
ea93863c147402b54407c3a1eff90043b55e76a08aa3ff4a8823469dd4d9def5
-
SHA512
76b90a53e6394d40c8a37a50ed5cfa93507797ee7395e5fe7d25a92c42f09564c039b3c285332282939f7aa208c421591fd18de4357786b71303d2be058a0c29
-
SSDEEP
12288:12iNb0oLtaQjlfRGqkDdu/pYVszai9YJgZ1gy:116gg0fR0ARoi9YJgZb
Score10/10-
Snake Keylogger payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-