General
-
Target
Cotización_C_489.pdf.exe
-
Size
1.2MB
-
Sample
210623-taeb5h8df2
-
MD5
124b94ecdf05968dfa1a5f6b52ee45cf
-
SHA1
b28ca385e59febffb3030f281afc13ea6818bad4
-
SHA256
0b3725e141c6adcb04e588533b8dc7a746f4bccc639400a043c4091490cd342d
-
SHA512
a2923a3ae9778927af643b17f9abd33561154de1ae194fa39368f7f631b7d7af81969cabf0de75f16577643452865cdfdbb9c41ef1689fe08d0291eb63474907
Static task
static1
Behavioral task
behavioral1
Sample
Cotización_C_489.pdf.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Cotización_C_489.pdf.exe
Resource
win10v20210408
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
mail.prozero-d.com - Port:
587 - Username:
afterdark@prozero-d.com - Password:
icui4cu2@@
Targets
-
-
Target
Cotización_C_489.pdf.exe
-
Size
1.2MB
-
MD5
124b94ecdf05968dfa1a5f6b52ee45cf
-
SHA1
b28ca385e59febffb3030f281afc13ea6818bad4
-
SHA256
0b3725e141c6adcb04e588533b8dc7a746f4bccc639400a043c4091490cd342d
-
SHA512
a2923a3ae9778927af643b17f9abd33561154de1ae194fa39368f7f631b7d7af81969cabf0de75f16577643452865cdfdbb9c41ef1689fe08d0291eb63474907
Score10/10-
Snake Keylogger Payload
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-