General
-
Target
2facfa5bb80933431ce452627dd71c6c9b5711799dea72732e1617622ec45c54.exe
-
Size
1.3MB
-
Sample
240702-bl3awavcmn
-
MD5
7e3694a4d525aecb407e7dfee160afee
-
SHA1
9e515221e99af422d0e7c76b3b90e9a259f67562
-
SHA256
2facfa5bb80933431ce452627dd71c6c9b5711799dea72732e1617622ec45c54
-
SHA512
1eb559e7d6cdb090fd16bb36aee866b156341ca95955313a73e1187cf7fbfbd7f5aea2d0c2a6b67394e94218899b79d977dddcdf1dcf587c45b6cf9a1388a7eb
-
SSDEEP
12288:o+WbFkpXD7n1FDoPNUCobwMtFTUhqxDd1XKm:o+4i3nnDAUCobwQ3h1R
Static task
static1
Behavioral task
behavioral1
Sample
2facfa5bb80933431ce452627dd71c6c9b5711799dea72732e1617622ec45c54.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2facfa5bb80933431ce452627dd71c6c9b5711799dea72732e1617622ec45c54.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
valleycountysar.org - Port:
26 - Username:
[email protected] - Password:
i~~Ga+6_-~V*
Targets
-
-
Target
2facfa5bb80933431ce452627dd71c6c9b5711799dea72732e1617622ec45c54.exe
-
Size
1.3MB
-
MD5
7e3694a4d525aecb407e7dfee160afee
-
SHA1
9e515221e99af422d0e7c76b3b90e9a259f67562
-
SHA256
2facfa5bb80933431ce452627dd71c6c9b5711799dea72732e1617622ec45c54
-
SHA512
1eb559e7d6cdb090fd16bb36aee866b156341ca95955313a73e1187cf7fbfbd7f5aea2d0c2a6b67394e94218899b79d977dddcdf1dcf587c45b6cf9a1388a7eb
-
SSDEEP
12288:o+WbFkpXD7n1FDoPNUCobwMtFTUhqxDd1XKm:o+4i3nnDAUCobwQ3h1R
Score10/10-
Snake Keylogger payload
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-