General
-
Target
e0fc3fbaa9aee9e5d558b4d7ce1cec7f.bin
-
Size
310KB
-
Sample
240624-d1f3aszbpj
-
MD5
c354e0aee8b84ba5b84c81996520782a
-
SHA1
1dbbd1c15b5f19b6bc1b974b3141941e8afac297
-
SHA256
a12c69ab0675f0760c06a65a89c5e8bbf9a520d8e483ff65f6c198dad043fa5f
-
SHA512
9bca570654434265bd817294bd9f60d79683010a07466fff9605dde14c1888d6490806ebf2def60ec2ab2d64c49410e115e2cb9ece7e98189bbe7f9945264710
-
SSDEEP
6144:Wf6JbjBxnZLTmpIvoMrNUQfw44PSiIFR98cfft4ZbmDUGHH6RDwg:Wf6Jbdxn0c7j44e1mAm5nGD
Static task
static1
Behavioral task
behavioral1
Sample
530ea48914b6c7e82e89532dd28463db5da66c80fbc0ad25b9e46471b1639260.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
530ea48914b6c7e82e89532dd28463db5da66c80fbc0ad25b9e46471b1639260.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
valleycountysar.org - Port:
26 - Username:
[email protected] - Password:
fY,FLoadtsiF
http://103.130.147.85
Targets
-
-
Target
530ea48914b6c7e82e89532dd28463db5da66c80fbc0ad25b9e46471b1639260.exe
-
Size
537KB
-
MD5
e0fc3fbaa9aee9e5d558b4d7ce1cec7f
-
SHA1
00656363e411748463937f255acb9daf174b80ed
-
SHA256
530ea48914b6c7e82e89532dd28463db5da66c80fbc0ad25b9e46471b1639260
-
SHA512
b8577b9a2b8a0ba66df7b6b772e9e109bea86448b7e58d50e46888bceea2475988cab0d3c40ad7a1d1a29dae29f9fc8baa9ae836828e800ef8055d97ffa61e26
-
SSDEEP
12288:/tu+ptgQ+8bw8e4FZp+nOo5PNkDsgKJv/v+PLuSn:/p2Q+Oe4FZkRv/6LB
Score10/10-
Snake Keylogger payload
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-