General
-
Target
Scan06632.exe
-
Size
273KB
-
Sample
210618-s5eaxktfa2
-
MD5
b174e33d5ab7f90d7164caae7453b114
-
SHA1
22c17f3cdd5819996b3c3359ec9758fecd6554dd
-
SHA256
b373e5a4e4057ab261f9f58af8b2ebe75f401fc7df1c4b5aa26d555ec2a1387e
-
SHA512
bd9b8783f37a3133ecdcdf34516a7a3984072f550bdae45d6544c22e60461e4a4e4da2cb5f175a49e172b35cd1c52d80635c4ed589c24f05a971f4f13a2ba4c0
Static task
static1
Behavioral task
behavioral1
Sample
Scan06632.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Scan06632.exe
Resource
win10v20210410
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
smtp.azebal.com - Port:
587 - Username:
kimone@azebal.com - Password:
$LfSkE^9
Targets
-
-
Target
Scan06632.exe
-
Size
273KB
-
MD5
b174e33d5ab7f90d7164caae7453b114
-
SHA1
22c17f3cdd5819996b3c3359ec9758fecd6554dd
-
SHA256
b373e5a4e4057ab261f9f58af8b2ebe75f401fc7df1c4b5aa26d555ec2a1387e
-
SHA512
bd9b8783f37a3133ecdcdf34516a7a3984072f550bdae45d6544c22e60461e4a4e4da2cb5f175a49e172b35cd1c52d80635c4ed589c24f05a971f4f13a2ba4c0
Score10/10-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-