General
-
Target
SHIPPING DOCUMENT & PL.rar
-
Size
470KB
-
Sample
210228-wqapsgwz82
-
MD5
b18d6f64d5753a3622483a43ed672365
-
SHA1
643dd7bde507ecccd68979f9a6f50c1c500b8795
-
SHA256
2496d8029af2fcd37d108e3461fa1f9b12c4217b034bd84f34b615b0f2e7bd7b
-
SHA512
0101cefdd28ea25eb94a6ec294152e3a98b2f10f0cc9729ae8d09cdd6ded38dd8947c09893e11d50b7250dba2683e2fadbe6967f7bd016b4b14e16c087b1107e
Static task
static1
Behavioral task
behavioral1
Sample
SHIPPING DOCUMENT & PL.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
SHIPPING DOCUMENT & PL.exe
Resource
win10v20201028
Malware Config
Targets
-
-
Target
SHIPPING DOCUMENT & PL.exe
-
Size
602KB
-
MD5
2d9e58aae7cb889e6fecc3ad4321685c
-
SHA1
8dc4098500977db1b6cce9e8050223988b35ee1c
-
SHA256
f8b66ad0f394bf4e2277c1dabb9cf3ec55e970acf67108759178046a5c268116
-
SHA512
a080705b3bea928eebd872999c7528944687751e69107d88235614ca28c38785556357270acf2647c8699a2de354151f84cbacb5641f7ec4d1abde940a678fd1
Score10/10-
Snake Keylogger Payload
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-