General
-
Target
MT_054_1017_037XLS.rar
-
Size
88KB
-
Sample
240702-l6wc6s1epr
-
MD5
882ba81c6ea18d9a5ab4b8d515efcbfe
-
SHA1
f452d12e5a8f3d2d79bc9a10e48ae3214dac001c
-
SHA256
0193ca7d65b1dfed6cda29b786e484adc6d29ff7ba0ab902231e5dceacad98b3
-
SHA512
93e6688e341a6733628f86df99df4d848967ba59cd1c59b9a19eae43c20acc785ce52b460ca02012de53b80386ba73267feb60b23883735ba9c466b107cfdcb4
-
SSDEEP
1536:TP8b/zukZqSDn6usRVvF9MUAJlt14UbvzU5aLnuAp0oQW+CqClJE2KyMfVKZ:TkvukESb6uAlg9lt1TbrU4uApANClJE6
Static task
static1
Behavioral task
behavioral1
Sample
MT_054_1017_037XLS.exe
Resource
win10v2004-20240611-en
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
jertcot.shop - Port:
587 - Username:
[email protected] - Password:
UjFGuShvgVH4 - Email To:
[email protected]
Targets
-
-
Target
MT_054_1017_037XLS.exe
-
Size
208KB
-
MD5
0c56b0d3c8f8d03c10f6ed2ff5d0ce0c
-
SHA1
b39448128f388b5cebe49a0eb5cb1683ee335157
-
SHA256
c0fc9128f7fe827ee7191be9c1d14a010304a8b9e8da343152e5ef1e0f4447ac
-
SHA512
de51d1ab1a0df95a511279a369a57c21633301774cf7a3e8ab28f6906e56c511d2001cd76ad04bdf01e170048c5fe9aab8f259de4c1933c6a9ef209fda83fc1d
-
SSDEEP
3072:wbQw54d0TZ0tShFwUPnS21mQbnc+BR0pKREX/WONBuwrhmc7U1iIyxpIhNXOXca1:DpdUZ0tu6uwrhmAZcrFsnLAg
-
Snake Keylogger payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-