General
-
Target
Baltic questionnaire.exe
-
Size
537KB
-
Sample
240622-wsxn7axhmg
-
MD5
e0fc3fbaa9aee9e5d558b4d7ce1cec7f
-
SHA1
00656363e411748463937f255acb9daf174b80ed
-
SHA256
530ea48914b6c7e82e89532dd28463db5da66c80fbc0ad25b9e46471b1639260
-
SHA512
b8577b9a2b8a0ba66df7b6b772e9e109bea86448b7e58d50e46888bceea2475988cab0d3c40ad7a1d1a29dae29f9fc8baa9ae836828e800ef8055d97ffa61e26
-
SSDEEP
12288:/tu+ptgQ+8bw8e4FZp+nOo5PNkDsgKJv/v+PLuSn:/p2Q+Oe4FZkRv/6LB
Static task
static1
Behavioral task
behavioral1
Sample
Baltic questionnaire.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Baltic questionnaire.exe
Resource
win10v2004-20240611-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
valleycountysar.org - Port:
26 - Username:
[email protected] - Password:
fY,FLoadtsiF
http://103.130.147.85
Targets
-
-
Target
Baltic questionnaire.exe
-
Size
537KB
-
MD5
e0fc3fbaa9aee9e5d558b4d7ce1cec7f
-
SHA1
00656363e411748463937f255acb9daf174b80ed
-
SHA256
530ea48914b6c7e82e89532dd28463db5da66c80fbc0ad25b9e46471b1639260
-
SHA512
b8577b9a2b8a0ba66df7b6b772e9e109bea86448b7e58d50e46888bceea2475988cab0d3c40ad7a1d1a29dae29f9fc8baa9ae836828e800ef8055d97ffa61e26
-
SSDEEP
12288:/tu+ptgQ+8bw8e4FZp+nOo5PNkDsgKJv/v+PLuSn:/p2Q+Oe4FZkRv/6LB
Score10/10-
Snake Keylogger payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-