General
-
Target
0ecf60ff337dc16beed8a7faff49d2992ef4fe0f4c76ffc07457a011b382da90.exe
-
Size
642KB
-
Sample
241210-clc7esvmfk
-
MD5
3b2fdddfea442b19d99bb076e61975a3
-
SHA1
f2f86158de5a5091e9279ee5bdd8ed23c82e4649
-
SHA256
0ecf60ff337dc16beed8a7faff49d2992ef4fe0f4c76ffc07457a011b382da90
-
SHA512
997e4191000d66dd7dade87c35e9502f025b76932c540aa7d2008a701c5661679b291a6800e79005e70c1f8caf41ece3441586d828cae3f14a13178da1bc480d
-
SSDEEP
12288:k9j0dY9shQg7WbxARan/jZtg4jy9KQHy9b8xlzS+STpS3NUrkR:Ldhl7WPn7Zmmwvy9LblIUu
Static task
static1
Behavioral task
behavioral1
Sample
0ecf60ff337dc16beed8a7faff49d2992ef4fe0f4c76ffc07457a011b382da90.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0ecf60ff337dc16beed8a7faff49d2992ef4fe0f4c76ffc07457a011b382da90.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.ozdenticaret.com.tr - Port:
587 - Username:
[email protected] - Password:
Ozd.135246 - Email To:
[email protected]
Targets
-
-
Target
0ecf60ff337dc16beed8a7faff49d2992ef4fe0f4c76ffc07457a011b382da90.exe
-
Size
642KB
-
MD5
3b2fdddfea442b19d99bb076e61975a3
-
SHA1
f2f86158de5a5091e9279ee5bdd8ed23c82e4649
-
SHA256
0ecf60ff337dc16beed8a7faff49d2992ef4fe0f4c76ffc07457a011b382da90
-
SHA512
997e4191000d66dd7dade87c35e9502f025b76932c540aa7d2008a701c5661679b291a6800e79005e70c1f8caf41ece3441586d828cae3f14a13178da1bc480d
-
SSDEEP
12288:k9j0dY9shQg7WbxARan/jZtg4jy9KQHy9b8xlzS+STpS3NUrkR:Ldhl7WPn7Zmmwvy9LblIUu
-
Snake Keylogger payload
-
Snakekeylogger family
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2