General
-
Target
2.exe
-
Size
747KB
-
Sample
210616-f2aalhcvg2
-
MD5
2f7d5751598d31089885f51a4dcd025f
-
SHA1
e9e0543e7b06499eaaaa2ff76f9c6fc2100e7559
-
SHA256
141945bbd508170021a1d4a06f40b0809f104e729743f047867ef9871c243ee3
-
SHA512
6f98e2a21014b12daf1cb17895d9c3ff63046d7af2a4de45e0c36bec5280b13a0dffc335ae5cb9842fcc97be844685dd89d21773bb38ca6f58224144ef023ff5
Static task
static1
Behavioral task
behavioral1
Sample
2.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
2.exe
Resource
win10v20210410
Malware Config
Extracted
Protocol: smtp- Host:
smtp.leeandhevv.com - Port:
587 - Username:
jesslyn@leeandhevv.com - Password:
NzsyRcTEW2
Extracted
snakekeylogger
Protocol: smtp- Host:
smtp.leeandhevv.com - Port:
587 - Username:
jesslyn@leeandhevv.com - Password:
NzsyRcTEW2
Targets
-
-
Target
2.exe
-
Size
747KB
-
MD5
2f7d5751598d31089885f51a4dcd025f
-
SHA1
e9e0543e7b06499eaaaa2ff76f9c6fc2100e7559
-
SHA256
141945bbd508170021a1d4a06f40b0809f104e729743f047867ef9871c243ee3
-
SHA512
6f98e2a21014b12daf1cb17895d9c3ff63046d7af2a4de45e0c36bec5280b13a0dffc335ae5cb9842fcc97be844685dd89d21773bb38ca6f58224144ef023ff5
Score10/10-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-