General
-
Target
Purchase Order No. 3109 Dated 28.01.2021.doc
-
Size
1.6MB
-
Sample
210128-xjcncrsfjj
-
MD5
028d561f0f1c0672747fb62cbbc047d7
-
SHA1
dafeae198cb24d63b614833c584b7c6ee1d82892
-
SHA256
1c981a1151b65e165e40445bae864206974e22c517aa7e3bfc44cafd3ac77062
-
SHA512
87b76c26989cb0875d8fc503f8ab29a09552ff87d7f910ba173a7f865946713eddc510dcd2ddfcae45863afdddf8f461189c8e87ed0e1bf1a1cd6788bd9bcba0
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order No. 3109 Dated 28.01.2021.doc
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Purchase Order No. 3109 Dated 28.01.2021.doc
Resource
win10v20201028
Malware Config
Targets
-
-
Target
Purchase Order No. 3109 Dated 28.01.2021.doc
-
Size
1.6MB
-
MD5
028d561f0f1c0672747fb62cbbc047d7
-
SHA1
dafeae198cb24d63b614833c584b7c6ee1d82892
-
SHA256
1c981a1151b65e165e40445bae864206974e22c517aa7e3bfc44cafd3ac77062
-
SHA512
87b76c26989cb0875d8fc503f8ab29a09552ff87d7f910ba173a7f865946713eddc510dcd2ddfcae45863afdddf8f461189c8e87ed0e1bf1a1cd6788bd9bcba0
Score10/10-
Snake Keylogger Payload
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Drops startup file
-
Loads dropped DLL
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetThreadContext
-