Overview

overview

10

Static

static

9

PURCHASE ORDER.exe

windows7_x64

10

PURCHASE ORDER.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PURCHASE ORDER.exe

  • Size

    576KB

  • Sample

    210129-gvmzvcq2e6

  • MD5

    38f6f05d0bff28a29420efaec6aeab43

  • SHA1

    d9e05a92b6edc27a491fced696eb77a7295510ab

  • SHA256

    4b6f46c5f5f309d1e5de63307f5e7eed976a56e864f854e53afa6bb1dc671faf

  • SHA512

    f6a4c851d7e496bff2db898c9d5e3c3786f8f68960be963e1cd325ee3429124394e18ecfb4ab4de683ba66bd81618904f801cb591ca335b5755a41a3aaab0769

Score
10/10
snakekeyloggerkeyloggerstealer

Malware Config

Targets

    • Target

      PURCHASE ORDER.exe

    • Size

      576KB

    • MD5

      38f6f05d0bff28a29420efaec6aeab43

    • SHA1

      d9e05a92b6edc27a491fced696eb77a7295510ab

    • SHA256

      4b6f46c5f5f309d1e5de63307f5e7eed976a56e864f854e53afa6bb1dc671faf

    • SHA512

      f6a4c851d7e496bff2db898c9d5e3c3786f8f68960be963e1cd325ee3429124394e18ecfb4ab4de683ba66bd81618904f801cb591ca335b5755a41a3aaab0769

    Score
    10/10
    snakekeyloggerkeyloggerstealer

    • Snake Keylogger

      Keylogger and Infostealer first seen in November 2020.

      stealerkeyloggersnakekeylogger

    • Snake Keylogger Payload

    • Beds Protector Packer

      Detects Beds Protector packer used to load .NET malware.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks