General
-
Target
e3c2797795813326d842d0d7973b5fbc8f0c797e920c96dc13c17d9705996e6d.exe
-
Size
522KB
-
Sample
241018-dfnxeawcrl
-
MD5
dabc9902751a8a1e7f0c36c78a433e50
-
SHA1
150b8cfe7f915505889bc15feb024322bfdb0cb9
-
SHA256
e3c2797795813326d842d0d7973b5fbc8f0c797e920c96dc13c17d9705996e6d
-
SHA512
156592e997420ae38b35248424303d7771b5d151377ffe2814ad4dd8ce8e7a2ec3cd2bc8e5462425cbfd9dcf300a5fd05d2b46704c54eb24d0c8bd2f6043674f
-
SSDEEP
12288:uA+WWzMfOW86l43w7Ypt2P3IuL1BWESyXZn6pe0wQ:uAWzMmm23wUS1L/WaB6pj
Static task
static1
Behavioral task
behavioral1
Sample
e3c2797795813326d842d0d7973b5fbc8f0c797e920c96dc13c17d9705996e6d.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e3c2797795813326d842d0d7973b5fbc8f0c797e920c96dc13c17d9705996e6d.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
e3c2797795813326d842d0d7973b5fbc8f0c797e920c96dc13c17d9705996e6d.exe
-
Size
522KB
-
MD5
dabc9902751a8a1e7f0c36c78a433e50
-
SHA1
150b8cfe7f915505889bc15feb024322bfdb0cb9
-
SHA256
e3c2797795813326d842d0d7973b5fbc8f0c797e920c96dc13c17d9705996e6d
-
SHA512
156592e997420ae38b35248424303d7771b5d151377ffe2814ad4dd8ce8e7a2ec3cd2bc8e5462425cbfd9dcf300a5fd05d2b46704c54eb24d0c8bd2f6043674f
-
SSDEEP
12288:uA+WWzMfOW86l43w7Ypt2P3IuL1BWESyXZn6pe0wQ:uAWzMmm23wUS1L/WaB6pj
-
Snake Keylogger payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-