General
-
Target
22b0dcc30c169644100916d06c39328f35a546a5b4a55a196dcc4d2b6a8197de
-
Size
630KB
-
Sample
241115-wfzm1ssmem
-
MD5
70289d25b830cd80af41120874eb1ee1
-
SHA1
ac76af075b1dd893200d57e6e9a3f7b24d476488
-
SHA256
22b0dcc30c169644100916d06c39328f35a546a5b4a55a196dcc4d2b6a8197de
-
SHA512
40c245c8bc5cdfd169abc4e7daadc7f90493a27cda447f27d403552600a33a72f754c478495ca98259e071113f4521423d18bcf1cca7c70eae82216a48d4440f
-
SSDEEP
12288:F3QiGR0dBOzDiCk5mQ0LnQyxzERfZ7sXmGUoFmz0WCJVMRsK:VoAOzHQ4nPzuZ7s27Im7CJVasK
Static task
static1
Behavioral task
behavioral1
Sample
22b0dcc30c169644100916d06c39328f35a546a5b4a55a196dcc4d2b6a8197de.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
22b0dcc30c169644100916d06c39328f35a546a5b4a55a196dcc4d2b6a8197de.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot7985379579:AAFFNXAHJz6n24A6xEGgMMms826UxvjorNA/sendMessage?chat_id=6370711846
Targets
-
-
Target
22b0dcc30c169644100916d06c39328f35a546a5b4a55a196dcc4d2b6a8197de
-
Size
630KB
-
MD5
70289d25b830cd80af41120874eb1ee1
-
SHA1
ac76af075b1dd893200d57e6e9a3f7b24d476488
-
SHA256
22b0dcc30c169644100916d06c39328f35a546a5b4a55a196dcc4d2b6a8197de
-
SHA512
40c245c8bc5cdfd169abc4e7daadc7f90493a27cda447f27d403552600a33a72f754c478495ca98259e071113f4521423d18bcf1cca7c70eae82216a48d4440f
-
SSDEEP
12288:F3QiGR0dBOzDiCk5mQ0LnQyxzERfZ7sXmGUoFmz0WCJVMRsK:VoAOzHQ4nPzuZ7s27Im7CJVasK
Score10/10-
Snake Keylogger payload
-
Snakekeylogger family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-