General
-
Target
catalogue.bin
-
Size
565KB
-
Sample
210727-q75x6hma4e
-
MD5
e712e8ee3d9d3bdf34029516d2755ca5
-
SHA1
5c8ad1cc914a225f386a6e8a3bdcb012580c33e2
-
SHA256
69fb813254cb7d90156e5787b232f46ee4229d64dc1353488a7991ba830c223a
-
SHA512
39b5c1b8d4a6e01a8588ae520683df143bc5e68b4f1bfd623accfaf67cf6c52e1663c5f0b3f3d55ee4bb144c8e0e570593eb17b04b288df23138da5305e7f932
Static task
static1
Behavioral task
behavioral1
Sample
catalogue.bin.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
catalogue.bin.exe
Resource
win10v20210410
Malware Config
Extracted
snakekeylogger
Protocol: smtp- Host:
smtp.seksiui.com - Port:
587 - Username:
dedaiko@seksiui.com - Password:
CcTduHh6
Targets
-
-
Target
catalogue.bin
-
Size
565KB
-
MD5
e712e8ee3d9d3bdf34029516d2755ca5
-
SHA1
5c8ad1cc914a225f386a6e8a3bdcb012580c33e2
-
SHA256
69fb813254cb7d90156e5787b232f46ee4229d64dc1353488a7991ba830c223a
-
SHA512
39b5c1b8d4a6e01a8588ae520683df143bc5e68b4f1bfd623accfaf67cf6c52e1663c5f0b3f3d55ee4bb144c8e0e570593eb17b04b288df23138da5305e7f932
Score10/10-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-