General
-
Target
IMG-0510777631307Xls.exe
-
Size
353KB
-
Sample
210617-lt2dd1vckx
-
MD5
aa0ca98e582c458eaaa189086e8f99e8
-
SHA1
8490364c087202db96e05012e380d9c6b123f4bc
-
SHA256
9f23e51a16cce134337030da823aad2fac76f3ff694a62f159d01538f17d75e8
-
SHA512
1db06a0b3fbea9be2d2815511d9772f8f2fedb33c44d346df9642f267b7864c6a68ea70fd4bcf065d0cb47a0fb34207510a0b487887e07bd021ff06321f2a24d
Static task
static1
Behavioral task
behavioral1
Sample
IMG-0510777631307Xls.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
IMG-0510777631307Xls.exe
Resource
win10v20210410
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
lagardan@yandex.com - Password:
pP!@*&@)555
Targets
-
-
Target
IMG-0510777631307Xls.exe
-
Size
353KB
-
MD5
aa0ca98e582c458eaaa189086e8f99e8
-
SHA1
8490364c087202db96e05012e380d9c6b123f4bc
-
SHA256
9f23e51a16cce134337030da823aad2fac76f3ff694a62f159d01538f17d75e8
-
SHA512
1db06a0b3fbea9be2d2815511d9772f8f2fedb33c44d346df9642f267b7864c6a68ea70fd4bcf065d0cb47a0fb34207510a0b487887e07bd021ff06321f2a24d
Score10/10-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-