General
-
Target
c48bab60d5b7b07da7e11fcb9df31e8641e7aeea1356200ad3ebdf1410db7a05
-
Size
504KB
-
Sample
240417-rvkeesca72
-
MD5
917bcb0928d76225e4d37ba04e1becf2
-
SHA1
e9c780a859701e39664e498b5b3895ec69c6aed5
-
SHA256
c48bab60d5b7b07da7e11fcb9df31e8641e7aeea1356200ad3ebdf1410db7a05
-
SHA512
73420b86cedd5e2fa52119a71dd3dac1c406b9adb0c2bb3c08c3040f12d70d4e46aeda2a5f47a9766e991d803d71831c662853b5ab66c756558bb91bda7d43ae
-
SSDEEP
12288:oOYYsiQU6teKGKkcW2WeI6WFM86H6/PZuCwVWMcAO:fWGMWHeAidH6ZoIfv
Static task
static1
Behavioral task
behavioral1
Sample
eb59a9f05a9e647b8a58832b7b17c2d72b46703b46ee95eee9c75c3b1e16c8f8.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
eb59a9f05a9e647b8a58832b7b17c2d72b46703b46ee95eee9c75c3b1e16c8f8.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.csmgalati.ro - Port:
587 - Username:
achizitii@csmgalati.ro - Password:
ciocarlan22
http://varders.kozow.com:8081
http://aborters.duckdns.org:8081
http://anotherarmy.dns.army:8081
Targets
-
-
Target
eb59a9f05a9e647b8a58832b7b17c2d72b46703b46ee95eee9c75c3b1e16c8f8.exe
-
Size
528KB
-
MD5
a7d836eb09297a23df69d9824f809453
-
SHA1
4ccfad4a85df914ba05213362f022483b73512e1
-
SHA256
eb59a9f05a9e647b8a58832b7b17c2d72b46703b46ee95eee9c75c3b1e16c8f8
-
SHA512
e31657d913740dd2ebd79282d25fa241a2ba0a9d14509a78fc67482cb712661297c8a38a527768b8e60bbd1c849e5c9d65616effc5c0cd6264d46556a6039d93
-
SSDEEP
12288:8AxLvnA7a5L1dDEyVJzceUN+Gegwf9pfPal46jzg7wypR:8Ax7nA7a91dYsJzceUNFZMNPO46/6f
Score10/10-
Snake Keylogger payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-