General
-
Target
c35a5064529bdfac908b22db56c9f874763a7f9562970828b2afd3dca5a53a05
-
Size
549KB
-
Sample
241016-f41l8ayfnr
-
MD5
99cf89ca25a9990c9b21e8b3228f2280
-
SHA1
bbc3cd09efbe5205d0791aa09fa55927cd2a8b60
-
SHA256
c35a5064529bdfac908b22db56c9f874763a7f9562970828b2afd3dca5a53a05
-
SHA512
cab9c279637ece8a02df86414dfce7c829660402cf393c80071af4569898d39851534fb5b39370c4141da208d5726e2150c4328792bb454ae5aafebd8ffe0cd1
-
SSDEEP
12288:o/nRunZUtCbQXJv7ftdAQHQfo2HVfSkpa5ICD4kdAozQ:wR0CtDXJ2fo2HVfj9Fe
Static task
static1
Behavioral task
behavioral1
Sample
c35a5064529bdfac908b22db56c9f874763a7f9562970828b2afd3dca5a53a05.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c35a5064529bdfac908b22db56c9f874763a7f9562970828b2afd3dca5a53a05.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
c35a5064529bdfac908b22db56c9f874763a7f9562970828b2afd3dca5a53a05
-
Size
549KB
-
MD5
99cf89ca25a9990c9b21e8b3228f2280
-
SHA1
bbc3cd09efbe5205d0791aa09fa55927cd2a8b60
-
SHA256
c35a5064529bdfac908b22db56c9f874763a7f9562970828b2afd3dca5a53a05
-
SHA512
cab9c279637ece8a02df86414dfce7c829660402cf393c80071af4569898d39851534fb5b39370c4141da208d5726e2150c4328792bb454ae5aafebd8ffe0cd1
-
SSDEEP
12288:o/nRunZUtCbQXJv7ftdAQHQfo2HVfSkpa5ICD4kdAozQ:wR0CtDXJ2fo2HVfj9Fe
-
Snake Keylogger payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-