General
-
Target
po1542.zip
-
Size
683KB
-
Sample
210504-lpaasbmds2
-
MD5
27d3b8274da9ec05d6a6a6583f80b65c
-
SHA1
06a64cc7fd27e291fb88d8e0c0316c934817c579
-
SHA256
955b747925b8c29a9f7d53c418263a86f7a43556479db61b6c25eb84f5f12681
-
SHA512
6b6690de067a605ef62a98ffab6c7d4cda7e631680e344bbe0e88533b1db0d677ae4194ddc85ba62affc2b0f09e88061174cb68dd44690735e5e513661b9f846
Static task
static1
Behavioral task
behavioral1
Sample
089d065fe8e39f8b19a726cb15ac216e352a5576f446c5fc38486f1fbb7a1d9c.bin.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
089d065fe8e39f8b19a726cb15ac216e352a5576f446c5fc38486f1fbb7a1d9c.bin.exe
Resource
win10v20210410
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.almatls.com - Port:
587 - Username:
ewalogs@almatls.com - Password:
0c0qf7xTL1
Targets
-
-
Target
089d065fe8e39f8b19a726cb15ac216e352a5576f446c5fc38486f1fbb7a1d9c.bin
-
Size
732KB
-
MD5
dc6c597848870c7c68143495ba2a1ec0
-
SHA1
1f1950e2728ff9ce2767ddefcf97929dbb9454f7
-
SHA256
089d065fe8e39f8b19a726cb15ac216e352a5576f446c5fc38486f1fbb7a1d9c
-
SHA512
cfddb959541c2f0cd9fd8fc82f8cfc2c55bb5439bd70f423e213228d4e332de0ee9a879dc03d5cd9c7f003d676dee3f49a4465d803802bb2e6c474ea4f1d6962
Score10/10-
Snake Keylogger Payload
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-