General
- Target d34e493e8e0dfa5e9a04ded3565e2ed4d60473148e63aeb3fca9a7f62dc90900.exe
- Size 557KB
- Sample240109-p87qrsceb6
- SHA256 d34e493e8e0dfa5e9a04ded3565e2ed4d60473148e63aeb3fca9a7f62dc90900
- MD5 2389b12a0615e47c8a6905d5d143b1fe
- SHA1 81d57dc456c00ef669aadbf19e66de90abf18701
- SHA512 b1f9c0f32035b92e6ef0a1284c166e9b81c3fee62ee35058cbfecc0c27590023a0d7f24879af4bfb89cd6e4629fb218151c779a1a8b49b85ab690b22de8b65f4
- SSDEEP 12288:aUCGifp6ZhQ/TVnr+0GBmc16s5uvOELNTSyC+FeZSygfd:wpfpWgr+0V6iXyZSygf
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d34e493e8e0dfa5e9a04ded3565e2ed4d60473148e63aeb3fca9a7f62dc90900.exe
Resource
win7-20231215-en
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
d34e493e8e0dfa5e9a04ded3565e2ed4d60473148e63aeb3fca9a7f62dc90900.exe
Resource
win10v2004-20231215-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target d34e493e8e0dfa5e9a04ded3565e2ed4d60473148e63aeb3fca9a7f62dc90900.exe
- Size 557KB
- SHA256 d34e493e8e0dfa5e9a04ded3565e2ed4d60473148e63aeb3fca9a7f62dc90900
- MD5 2389b12a0615e47c8a6905d5d143b1fe
- SHA1 81d57dc456c00ef669aadbf19e66de90abf18701
- SHA512 b1f9c0f32035b92e6ef0a1284c166e9b81c3fee62ee35058cbfecc0c27590023a0d7f24879af4bfb89cd6e4629fb218151c779a1a8b49b85ab690b22de8b65f4
- SSDEEP 12288:aUCGifp6ZhQ/TVnr+0GBmc16s5uvOELNTSyC+FeZSygfd:wpfpWgr+0V6iXyZSygf
- MD5 SHA1 SHA512 SSDEEP
Score10/10-
Snake Keylogger payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext