General
-
Target
d8df8ae0a2b685d4a9e0e2bc5c624c2b8b9be74d8a0ce6d00ba982e9077398e4.exe
-
Size
497KB
-
Sample
241016-gd9ymsvgne
-
MD5
50e9a50199c9bfa7aa74c1181901c401
-
SHA1
34044f843bd8d705e5165d137d3286edd7c75cfe
-
SHA256
d8df8ae0a2b685d4a9e0e2bc5c624c2b8b9be74d8a0ce6d00ba982e9077398e4
-
SHA512
25175cf756febc6e8427b9140a1ca3793cebbea1a9611bc790f34136fa0ffadc31480faca76ea4010a50ee0014c62787d7514ac4db9612311e7675d82afcbb93
-
SSDEEP
12288:wQUSPFoVcNNMRoFt2JY0KlkWM9iPcPo3LSQXDUEFxj:wOdNKRA4YDdPc2SAZX
Static task
static1
Behavioral task
behavioral1
Sample
d8df8ae0a2b685d4a9e0e2bc5c624c2b8b9be74d8a0ce6d00ba982e9077398e4.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
d8df8ae0a2b685d4a9e0e2bc5c624c2b8b9be74d8a0ce6d00ba982e9077398e4.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
d8df8ae0a2b685d4a9e0e2bc5c624c2b8b9be74d8a0ce6d00ba982e9077398e4.exe
-
Size
497KB
-
MD5
50e9a50199c9bfa7aa74c1181901c401
-
SHA1
34044f843bd8d705e5165d137d3286edd7c75cfe
-
SHA256
d8df8ae0a2b685d4a9e0e2bc5c624c2b8b9be74d8a0ce6d00ba982e9077398e4
-
SHA512
25175cf756febc6e8427b9140a1ca3793cebbea1a9611bc790f34136fa0ffadc31480faca76ea4010a50ee0014c62787d7514ac4db9612311e7675d82afcbb93
-
SSDEEP
12288:wQUSPFoVcNNMRoFt2JY0KlkWM9iPcPo3LSQXDUEFxj:wOdNKRA4YDdPc2SAZX
-
Snake Keylogger payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-