General
-
Target
e5c2ca734e0aaf255809667c558bad65384fe32f5a5fa2b7152cf01958916943.exe
-
Size
514KB
-
Sample
240928-cedjlstcqh
-
MD5
d3720192678d263171733ef9ba7fa67c
-
SHA1
1215ed86a8d470428d98cfe91eafb13c491dbcb4
-
SHA256
e5c2ca734e0aaf255809667c558bad65384fe32f5a5fa2b7152cf01958916943
-
SHA512
037563164849d5ae7db4acd308e45fb7cbffc3f564ba71a09cc6a6d8c9c764aa95f69667cbb40783cd026fa599b7bb3c3249c4abee4d142f027c4d6e62c59999
-
SSDEEP
12288:8tLn7qQ74Si3SW2HRawGaSUtEry10Vlnv9AVwu:o7J7niiW2xaHmClnKVwu
Static task
static1
Behavioral task
behavioral1
Sample
e5c2ca734e0aaf255809667c558bad65384fe32f5a5fa2b7152cf01958916943.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e5c2ca734e0aaf255809667c558bad65384fe32f5a5fa2b7152cf01958916943.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
e5c2ca734e0aaf255809667c558bad65384fe32f5a5fa2b7152cf01958916943.exe
-
Size
514KB
-
MD5
d3720192678d263171733ef9ba7fa67c
-
SHA1
1215ed86a8d470428d98cfe91eafb13c491dbcb4
-
SHA256
e5c2ca734e0aaf255809667c558bad65384fe32f5a5fa2b7152cf01958916943
-
SHA512
037563164849d5ae7db4acd308e45fb7cbffc3f564ba71a09cc6a6d8c9c764aa95f69667cbb40783cd026fa599b7bb3c3249c4abee4d142f027c4d6e62c59999
-
SSDEEP
12288:8tLn7qQ74Si3SW2HRawGaSUtEry10Vlnv9AVwu:o7J7niiW2xaHmClnKVwu
-
Snake Keylogger payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-