General
-
Target
SWIFT.exe
-
Size
1.0MB
-
Sample
241223-rhk57a1rdj
-
MD5
ca73a7be6faac5bb95edd742b6648914
-
SHA1
f49d9442c3608a5f58ce93614f5c81aff19afb2d
-
SHA256
937165f6ec620fd90744f5d180ffdaac029bda7ced16debce856dba23aa60728
-
SHA512
a9fb2f9b37627ec6f0f5f16b56ea20d80f3054d72f60e23a15b759d1806a0ccb1ee6fc31d1ac0388af5489bb18307c54b228f675cd3670294e32804282a576bd
-
SSDEEP
24576:MqDEvCTbMWu7rQYlBQcBiT6rprG8aFu/Pv8Et5r:MTvC/MTQYxsWR7aFePvB5
Static task
static1
Behavioral task
behavioral1
Sample
SWIFT.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
SWIFT.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot8171365907:AAFhWO_13bnElnPqwo1PSMXeHNO4L26rV00/sendMessage?chat_id=7361435574
Targets
-
-
Target
SWIFT.exe
-
Size
1.0MB
-
MD5
ca73a7be6faac5bb95edd742b6648914
-
SHA1
f49d9442c3608a5f58ce93614f5c81aff19afb2d
-
SHA256
937165f6ec620fd90744f5d180ffdaac029bda7ced16debce856dba23aa60728
-
SHA512
a9fb2f9b37627ec6f0f5f16b56ea20d80f3054d72f60e23a15b759d1806a0ccb1ee6fc31d1ac0388af5489bb18307c54b228f675cd3670294e32804282a576bd
-
SSDEEP
24576:MqDEvCTbMWu7rQYlBQcBiT6rprG8aFu/Pv8Et5r:MTvC/MTQYxsWR7aFePvB5
Score10/10-
Snake Keylogger payload
-
Snakekeylogger family
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-