General
-
Target
3af41da6cc3321fb4954e35e6f2f13ed7c2cc547f43eb1b9a2cfd4ed9d38c344.exe
-
Size
560KB
-
Sample
241023-bmm8cawakq
-
MD5
6489c2a2edb54bb6564df9cb218edf05
-
SHA1
cf9ea9f4973f9b438f9dedbec8a714b78611c84b
-
SHA256
3af41da6cc3321fb4954e35e6f2f13ed7c2cc547f43eb1b9a2cfd4ed9d38c344
-
SHA512
7ab3e215ff9d8330bac168e5f60fd91e270ebbcd4fab027e2bc749d6fd7966a56a495daf9113e550830ec4ca66543c2de22fef363bdc9fa66ffe356d8976feb6
-
SSDEEP
12288:yfAgXkhMOoltiJirLMW6diPxsElSiiGiLaD8Lbu:wkh5oDiJgLMWtxIaD8H
Static task
static1
Behavioral task
behavioral1
Sample
3af41da6cc3321fb4954e35e6f2f13ed7c2cc547f43eb1b9a2cfd4ed9d38c344.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3af41da6cc3321fb4954e35e6f2f13ed7c2cc547f43eb1b9a2cfd4ed9d38c344.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
3af41da6cc3321fb4954e35e6f2f13ed7c2cc547f43eb1b9a2cfd4ed9d38c344.exe
-
Size
560KB
-
MD5
6489c2a2edb54bb6564df9cb218edf05
-
SHA1
cf9ea9f4973f9b438f9dedbec8a714b78611c84b
-
SHA256
3af41da6cc3321fb4954e35e6f2f13ed7c2cc547f43eb1b9a2cfd4ed9d38c344
-
SHA512
7ab3e215ff9d8330bac168e5f60fd91e270ebbcd4fab027e2bc749d6fd7966a56a495daf9113e550830ec4ca66543c2de22fef363bdc9fa66ffe356d8976feb6
-
SSDEEP
12288:yfAgXkhMOoltiJirLMW6diPxsElSiiGiLaD8Lbu:wkh5oDiJgLMWtxIaD8H
-
Snake Keylogger payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-