Overview
overview
10Static
static
3BL.exe
windows7-x64
10BL.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Bombinatin...og.dll
windows7-x64
1Bombinatin...og.dll
windows10-2004-x64
1Ungarnsopholdene.com
windows7-x64
Ungarnsopholdene.com
windows10-2004-x64
keywords.vbs
windows7-x64
1keywords.vbs
windows10-2004-x64
1General
-
Target
BL.exe
-
Size
621KB
-
Sample
240131-s3cvzshccj
-
MD5
834935cdef3e5f521c57477d800cb65b
-
SHA1
1d8f8d0011bc89b07ae841855d607095e89ff23f
-
SHA256
43b991acd7e56190c2a9e4ead9a0c28e713908adc7d22e12ae8941efea9e8883
-
SHA512
3855a6c07c4fac24f84f4bff7fc8b8b072bf26229570dcd4c5f43cd438d36f8abb63ccdcfca7d2a7dc0caddd30d013e7f2fe714e54a9fcb456dfa56ac7d9a916
-
SSDEEP
12288:MkKnLVq69Hrc82yTPZodHtRWztKK7RG1Jz8Ap2x9c8Q04fz/sGoisDsCVVLC+HLh:AQy6ONsqLC+HL3eTEvTmGC5TrQ
Static task
static1
Behavioral task
behavioral1
Sample
BL.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
BL.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
Bombinating60/Gnidningsmodstande/vtablog.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
Bombinating60/Gnidningsmodstande/vtablog.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
Ungarnsopholdene.com
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
Ungarnsopholdene.com
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
keywords.vbs
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
keywords.vbs
Resource
win10v2004-20231215-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
megatechcontrol.com - Port:
587 - Username:
[email protected] - Password:
megatech1#
Targets
-
-
Target
BL.exe
-
Size
621KB
-
MD5
834935cdef3e5f521c57477d800cb65b
-
SHA1
1d8f8d0011bc89b07ae841855d607095e89ff23f
-
SHA256
43b991acd7e56190c2a9e4ead9a0c28e713908adc7d22e12ae8941efea9e8883
-
SHA512
3855a6c07c4fac24f84f4bff7fc8b8b072bf26229570dcd4c5f43cd438d36f8abb63ccdcfca7d2a7dc0caddd30d013e7f2fe714e54a9fcb456dfa56ac7d9a916
-
SSDEEP
12288:MkKnLVq69Hrc82yTPZodHtRWztKK7RG1Jz8Ap2x9c8Q04fz/sGoisDsCVVLC+HLh:AQy6ONsqLC+HL3eTEvTmGC5TrQ
Score10/10-
Snake Keylogger payload
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
-
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
17ed1c86bd67e78ade4712be48a7d2bd
-
SHA1
1cc9fe86d6d6030b4dae45ecddce5907991c01a0
-
SHA256
bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
-
SHA512
0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
-
SSDEEP
192:eY24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35Ol+Sl:E8QIl975eXqlWBrz7YLOl+
Score3/10 -
-
-
Target
Bombinating60/Gnidningsmodstande/vtablog.dll
-
Size
268KB
-
MD5
35119e61479373ba5d7433f106556e79
-
SHA1
096a7d227eb2514d76ec5d10bfd1cf165d4a9177
-
SHA256
f21d9de02c67e51bb9f7163f676f2d4710b2befae04fd0751a63cf1278c48a3c
-
SHA512
21318d0924393c8269419df5acc0c07ca2f754fd9d9ad80d393cf7ebec1b16986d123f2775ae210383b7faa106ed84e829c949004a123da844c07f2b46387453
-
SSDEEP
3072:s1vaCg+eY9yp71driAAYBnk/+eeaQyJen3n83fucakiD88iryUBw:ovDgZYq/rzfNufuceD5UBw
Score1/10 -
-
-
Target
Ungarnsopholdene.Com
-
Size
156KB
-
MD5
01fad2207751386929d13b28baf07c67
-
SHA1
41bc181264da05aaaf86a510cf4a1f4f4b6a4336
-
SHA256
62b9c65e6280157e2771a339cd07ec7a26807a957cdb005b9fcef14557fdf41b
-
SHA512
b57c4073488384d8a359d1c8872519893212768f4261d5bcfa8e2cf558708bc3737fd2d8540705d9958e11127ebd9fb1cc2b526f95252facf0a4af74c570af01
-
SSDEEP
3072:bUwaHsSBUuXCh7TAJbIV5L7IKAt7LMEVHFuwWBi4vIEZsh04LstDvwFRnYaA:XaMSKvZMs/UKAtnluwWg4/HtzwFiaA
Score1/10 -
-
-
Target
keywords.txt
-
Size
1010B
-
MD5
4d3c8d141484bbb0b8be03c13894ec9f
-
SHA1
1fbb29a4d6a1f48745e6d67bfa110306bc54c6ba
-
SHA256
c74e743057bfb38a767f3666df1d16587e2e529a070d1621be0e737366011471
-
SHA512
e4b9dd5c3585c24301ac71d7849616d680b25d2b340192c31c3de38a9546564cb30aa1b08bdbcba9e3b87303cd5f3bdb93e37c399bc9d056a68b9bbc7a0a3329
Score1/10 -