General
-
Target
Tax Invoice.exe
-
Size
875KB
-
Sample
210622-vhjfkpgx16
-
MD5
cb892d4aa19c97ee133b9c33816cd8b2
-
SHA1
1cd234a215385def2fc046e0809489cab4f5070d
-
SHA256
c3563e777c01c0ea26f7a8f26e598dacd68d096966011da76a5311f09ba21614
-
SHA512
df7dcfffda6c3c2a077b6fb2bc800d79cc86f80e6d6ccee91aed8297b4f7e91258b885bf4989fc0c297a367159ea8dcdee9e6f23531755202a2ee4f3ed0f9d7a
Static task
static1
Behavioral task
behavioral1
Sample
Tax Invoice.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Tax Invoice.exe
Resource
win10v20210410
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.iykmoreentrprise.org - Port:
587 - Username:
zalatexinteriors@iykmoreentrprise.org - Password:
Z&6s7s.YLZZi
Targets
-
-
Target
Tax Invoice.exe
-
Size
875KB
-
MD5
cb892d4aa19c97ee133b9c33816cd8b2
-
SHA1
1cd234a215385def2fc046e0809489cab4f5070d
-
SHA256
c3563e777c01c0ea26f7a8f26e598dacd68d096966011da76a5311f09ba21614
-
SHA512
df7dcfffda6c3c2a077b6fb2bc800d79cc86f80e6d6ccee91aed8297b4f7e91258b885bf4989fc0c297a367159ea8dcdee9e6f23531755202a2ee4f3ed0f9d7a
Score10/10-
Snake Keylogger Payload
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-