General
-
Target
COA for Product Invoice.exe
-
Size
559KB
-
Sample
210125-8f527kbenx
-
MD5
19b0a3fbce36d32813f951abfc69604c
-
SHA1
57675d39a950a36dd7e79d8f12b1e911e6cab3aa
-
SHA256
1265889345c3f88677338ff24c4c410e99e137fb7c4c63d2f791d39f8f13f5d8
-
SHA512
b2828d23e6d1157dedfa1789d3412d1accb655e10ee2affeb6b718a9ea37b2e6fce689147c1ff39915cdd751152053b1cc39f33cd312c77e98233cb797cb5cdc
Static task
static1
Behavioral task
behavioral1
Sample
COA for Product Invoice.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
COA for Product Invoice.exe
Resource
win10v20201028
Malware Config
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
smt.treat@yandex.com - Password:
WyhjVTBX5hjrgu7
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
smt.treat@yandex.com
Targets
-
-
Target
COA for Product Invoice.exe
-
Size
559KB
-
MD5
19b0a3fbce36d32813f951abfc69604c
-
SHA1
57675d39a950a36dd7e79d8f12b1e911e6cab3aa
-
SHA256
1265889345c3f88677338ff24c4c410e99e137fb7c4c63d2f791d39f8f13f5d8
-
SHA512
b2828d23e6d1157dedfa1789d3412d1accb655e10ee2affeb6b718a9ea37b2e6fce689147c1ff39915cdd751152053b1cc39f33cd312c77e98233cb797cb5cdc
Score10/10-
Snake Keylogger Payload
-
Drops startup file
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetThreadContext
-