General
-
Target
1e2e668213a67dba5e1a30cd974a8a80a9623137fd1abdbf8a18770f25ad1172_dump.exe
-
Size
130KB
-
Sample
240713-rrwnaawfma
-
MD5
1e6b4ea7b47a013581faf6618a371a07
-
SHA1
1c92c7d8a38e0fa5bfd852fee7b196def1e6341d
-
SHA256
468dcc14bf6cafae37933064c9263ceeb85f2500e8c3d8889a7121c408604cdd
-
SHA512
a016b8207910aa919651a2f737a5e50a1c2bfc29006eb07debe8a9fa82bf1c409bbe95c03969e579fd48570fcef047fb50267bb596a5727633ad842f0e391a67
-
SSDEEP
3072:YCDqZtIG+1m87Qc04NsiNQbtS+wjosLYwvxUSHDbY:+ZtIR1m8fQbQ+4ASjb
Behavioral task
behavioral1
Sample
1e2e668213a67dba5e1a30cd974a8a80a9623137fd1abdbf8a18770f25ad1172_dump.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
1e2e668213a67dba5e1a30cd974a8a80a9623137fd1abdbf8a18770f25ad1172_dump.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.ba-theatre.com - Port:
587 - Username:
[email protected] - Password:
juddba123 - Email To:
[email protected]
Targets
-
-
Target
1e2e668213a67dba5e1a30cd974a8a80a9623137fd1abdbf8a18770f25ad1172_dump.exe
-
Size
130KB
-
MD5
1e6b4ea7b47a013581faf6618a371a07
-
SHA1
1c92c7d8a38e0fa5bfd852fee7b196def1e6341d
-
SHA256
468dcc14bf6cafae37933064c9263ceeb85f2500e8c3d8889a7121c408604cdd
-
SHA512
a016b8207910aa919651a2f737a5e50a1c2bfc29006eb07debe8a9fa82bf1c409bbe95c03969e579fd48570fcef047fb50267bb596a5727633ad842f0e391a67
-
SSDEEP
3072:YCDqZtIG+1m87Qc04NsiNQbtS+wjosLYwvxUSHDbY:+ZtIR1m8fQbQ+4ASjb
Score10/10-
Snake Keylogger payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-